diff --git a/conformance/docs/error-codes.md b/conformance/docs/error-codes.md index e8f87686..d60bef6d 100644 --- a/conformance/docs/error-codes.md +++ b/conformance/docs/error-codes.md @@ -26,7 +26,7 @@ Look up a code from a failed or unverified check here: what it means and how to | Code | Description | How to fix | |------|-------------|------------| | TR-RTE-001 | `runtime` is missing or not an object, or `runtime.platform` is not in the registered set, or is `software-only` at Level 1 and above | Use a value from the `runtime.platform` enum in `schemas/trace-claim.json`. `software-only` carries no hardware attestation evidence and is accepted only at Level 0 | -| TR-RTE-002 | `runtime.measurement` is not a valid `sha256:` digest | Provide a 64-character hex digest prefixed with `sha256:`; for Level 0 all-zeros is conventional | +| TR-RTE-002 | `runtime.measurement` is not a valid `sha256:` or `sha384:` digest | Provide `sha256:` + 64 hex chars or `sha384:` + 96 hex chars; format only, all-zero values also match this check | | TR-RTE-003 | `runtime.rim_uri` is present and is not an `https://` URI | Remove `runtime.rim_uri` if not using a RIM, or set it to an `https://` URI. The URI is not resolved and the manifest behind it is not checked; this is a format check | | TR-RTE-004 | Level 1+ verification is missing the verifier challenge nonce or the nonce does not match | Supply the verifier's expected nonce and require the attested runtime nonce to match it | @@ -52,7 +52,7 @@ Look up a code from a failed or unverified check here: what it means and how to | Code | Description | How to fix | |------|-------------|------------| -| TR-TXN-001 | `tool_transcript.hash` is not a valid `sha256:` digest | Set `tool_transcript.hash` to `sha256:` + 64 hex chars of the Merkle root of the tool call log | +| TR-TXN-001 | `tool_transcript.hash` is not a valid `sha256:` or `sha384:` digest | Set `tool_transcript.hash` to `sha256:` + 64 hex chars or `sha384:` + 96 hex chars of the Merkle root of the tool call log | | TR-TXN-002 | `tool_transcript.call_count` is negative or not an integer | Set `tool_transcript.call_count` to a non-negative integer (0 is valid for sessions with no tool calls) | ## TR-ANC: Transparency @@ -67,4 +67,4 @@ Look up a code from a failed or unverified check here: what it means and how to | Code | Description | How to fix | |------|-------------|------------| | TR-SCA-001 | `build_provenance.slsa_level` is not 0 to 3 | Set `build_provenance.slsa_level` to an integer 0 to 3 matching your SLSA build level | -| TR-SCA-002 | `build_provenance.digest` is not a valid `sha256:` digest | Set `build_provenance.digest` to `sha256:` + 64 hex chars of the container image or artifact digest | +| TR-SCA-002 | `build_provenance.digest` is not a valid `sha256:` or `sha384:` digest | Set `build_provenance.digest` to `sha256:` + 64 hex chars or `sha384:` + 96 hex chars of the container image or artifact digest | diff --git a/conformance/docs/levels.md b/conformance/docs/levels.md index c0efff76..23e2bc51 100644 --- a/conformance/docs/levels.md +++ b/conformance/docs/levels.md @@ -76,7 +76,7 @@ Level 0 records are signed with a key kept in ordinary software rather than in s Level 1 adds hardware attestation: the record names the TEE (trusted execution environment, a processor mode that keeps a program's memory sealed off) it ran in and the measurement (a fingerprint of the code loaded into it). The suite checks that these fields are well formed; it does not verify the hardware's signed report, which is a separate step (see [Known limitations](../LIMITATIONS.md)). -`runtime.platform` must be a value from the `runtime.platform` enum in `schemas/trace-claim.json` other than `software-only`, which carries no hardware attestation evidence. The measurement must be non-zero. `appraisal.status` must be `"affirming"` (TR-APR-005). +`runtime.platform` must be a value from the `runtime.platform` enum in `schemas/trace-claim.json` other than `software-only`, which carries no hardware attestation evidence. `runtime.measurement` must be a valid `sha256:` or `sha384:` digest (TR-RTE-002 checks format only; all-zero values also match this check). `appraisal.status` must be `"affirming"` (TR-APR-005). **Minimum conformant Level 1 record** (changes from Level 0 in bold context): @@ -124,7 +124,7 @@ Level 1 adds hardware attestation: the record names the TEE (trusted execution e **What causes a Level 1 failure over Level 0:** - `runtime.platform` is `"software-only"`: TR-RTE-001 -- `runtime.measurement` is all zeros: TR-RTE-002 (all-zero is invalid at Level 1) +- `runtime.measurement` is missing or not a valid `sha256:` or `sha384:` digest: TR-RTE-002 (format only; all-zero values also match this check) - `build_provenance` missing entirely: TR-SCA-001, TR-SCA-002 - `appraisal.status` is `"none"`: while not a hard schema violation, a conformant Level 1 record should carry `"affirming"`; TR-APR-005 reports this from Level 1 and skips it at Level 0 @@ -152,7 +152,7 @@ The `transparency` field must be an HTTPS URI with a host, pointing to a SCITT r **What causes a Level 2 failure over Level 1:** -- `tool_transcript.hash` missing or not a valid `sha256:` digest: TR-TXN-001 +- `tool_transcript.hash` missing or not a valid `sha256:` or `sha384:` digest: TR-TXN-001 - `tool_transcript.call_count` negative or not an integer: TR-TXN-002 - `transparency` is absent or empty, is not a string, or is not an `https://` URI with a host: TR-ANC-001 - no anchor receipt was supplied, the receipt is malformed, or its inclusion proof does not reproduce the committed `merkle_root`: TR-ANC-002. A record cannot reach Level 2 on a URI alone: pass the receipt with `--receipt` diff --git a/conformance/docs/modules.md b/conformance/docs/modules.md index 4570f677..0848f65d 100644 --- a/conformance/docs/modules.md +++ b/conformance/docs/modules.md @@ -11,6 +11,6 @@ The table below uses the record's own field names (in code font). The [conforman | [Runtime](modules/tr-rte.md) | TR-RTE | §3.1 | TEE platform enum, measurement format, RIM URI scheme, and verifier-issued nonce comparison | | [Policy](modules/tr-pol.md) | TR-POL | §3.1 | Policy bundle hash format, enforcement mode values, and whether the bundle at `policy_uri` has the declared digest | | [Appraisal](modules/tr-apr.md) | TR-APR | §3.1 | Appraisal status enum, verifier URI form, `policy_ref` URI form, and timestamp plausibility. The appraisal policy is never resolved | -| [Transcript](modules/tr-txn.md) | TR-TXN | §3.1 | Tool-call transcript hash binding | +| [Transcript](modules/tr-txn.md) | TR-TXN | §3.1 | Tool-call transcript hash format (`sha256:` or `sha384:`) and call count | | [Transparency](modules/tr-anc.md) | TR-ANC | §3.2 | SCITT receipt URI form (TR-ANC-001), and offline replay of the inclusion proof against the committed Merkle root when a receipt is supplied (TR-ANC-002). The URI itself is never resolved | -| [Provenance](modules/tr-sca.md) | TR-SCA | §3.1 | SLSA provenance level and digest format | +| [Provenance](modules/tr-sca.md) | TR-SCA | §3.1 | SLSA provenance level and digest format (`sha256:` or `sha384:`) | diff --git a/conformance/docs/modules/tr-sca.md b/conformance/docs/modules/tr-sca.md index e238a37a..9eb3dd5e 100644 --- a/conformance/docs/modules/tr-sca.md +++ b/conformance/docs/modules/tr-sca.md @@ -7,4 +7,4 @@ Checks the record's statement about how the agent's software was built: the SLSA | Test ID | Description | Positive Case | Negative Case | |---------|-------------|---------------|---------------| | TR-SCA-001 | `build_provenance.slsa_level` is 0 to 3 | `0`, `1`, `2`, `3` | `4`, `5`, `-1`, `"high"`, absent | -| TR-SCA-002 | `build_provenance.digest` is a valid `sha256:` digest | `sha256:` followed by 64 hex chars | missing, wrong prefix, wrong length | +| TR-SCA-002 | `build_provenance.digest` is a valid `sha256:` or `sha384:` digest | `sha256:` + 64 hex chars, `sha384:` + 96 hex chars | missing, wrong prefix, wrong length | diff --git a/conformance/docs/modules/tr-txn.md b/conformance/docs/modules/tr-txn.md index 8e7a89be..fa8d43e2 100644 --- a/conformance/docs/modules/tr-txn.md +++ b/conformance/docs/modules/tr-txn.md @@ -6,5 +6,5 @@ Checks the record's summary of the tool calls the agent made: a fingerprint of t | Test ID | Description | Positive Case | Negative Case | |---------|-------------|---------------|---------------| -| TR-TXN-001 | `tool_transcript.hash` is a valid `sha256:` digest | `sha256:` followed by 64 hex chars | missing, wrong prefix, wrong length | +| TR-TXN-001 | `tool_transcript.hash` is a valid `sha256:` or `sha384:` digest | `sha256:` + 64 hex chars, `sha384:` + 96 hex chars | missing, wrong prefix, wrong length | | TR-TXN-002 | `tool_transcript.call_count` is a non-negative integer | `0`, `1`, `42` | `-1`, `"three"`, absent | diff --git a/conformance/schemas/trace-claim.json b/conformance/schemas/trace-claim.json index de8722a7..129e3bd8 100644 --- a/conformance/schemas/trace-claim.json +++ b/conformance/schemas/trace-claim.json @@ -1,486 +1,894 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://agentrust-io.com/schema/trace-v0.2.json", - "title": "TRACE Trust Record", - "description": "A TRACE v0.2 Trust Record: a signed governance record for an AI agent execution, which can carry hardware attestation evidence.", - "type": "object", - "required": [ - "eat_profile", - "iat", - "subject", - "model", - "runtime", - "policy", - "data_class", - "build_provenance", - "appraisal", - "cnf" - ], - "properties": { - "eat_profile": { - "type": "string", - "const": "tag:agentrust-io.com,2026:trace-v0.2", - "description": "EAT profile URI identifying this as a TRACE v0.2 Trust Record." - }, - "iat": { - "type": "integer", - "description": "Issued-at time as Unix epoch seconds.", - "minimum": 1700000000 - }, - "subject": { - "type": "string", - "description": "Workload identity as a SPIFFE SVID URI or DID URI.", - "pattern": "^(spiffe://|did:)" - }, - "model": { - "type": "object", - "description": "Model identity and provenance.", - "required": [ - "provider", - "model_id" - ], - "properties": { - "provider": { - "type": "string", - "description": "Model provider (e.g. 'example-provider')." - }, - "model_id": { - "type": "string", - "description": "Model identifier as used by the provider." - }, - "version": { - "type": "string", - "description": "Model version or snapshot identifier." - }, - "weights_digest": { - "type": "string", - "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.", - "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" - }, - "aibom_uri": { - "type": "string", - "format": "uri", - "description": "URI to SPDX 3.0 AI Profile or CycloneDX 1.7 ML-BOM for this model." - } - }, - "additionalProperties": false - }, - "runtime": { - "type": "object", - "description": "TEE measurement chain binding the workload to hardware.", - "required": [ - "platform", - "measurement" - ], - "properties": { - "platform": { - "type": "string", - "enum": [ - "intel-tdx", - "amd-sev-snp", - "azure-cvm-sev-snp", - "nvidia-h100", - "nvidia-blackwell", - "aws-nitro", - "arm-cca", - "google-confidential-space", - "tpm2", - "software-only" - ], - "description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence." - }, - "measurement": { - "type": "string", - "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).", - "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" - }, - "rim_uri": { - "type": "string", - "format": "uri", - "description": "URI to the vendor-published Reference Integrity Manifest for this measurement." - }, - "nonce": { - "type": "string", - "description": "Freshness nonce binding the attestation report to this record (base64url, no padding)." - }, - "firmware_version": { - "type": "string", - "description": "Firmware or microcode version included in the measurement." - } - }, - "additionalProperties": false - }, - "policy": { - "type": "object", - "description": "Policy bundle sealed to the TEE measurement.", - "required": [ - "bundle_hash", - "enforcement_mode" - ], - "properties": { - "bundle_hash": { - "type": "string", - "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.", - "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" - }, - "enforcement_mode": { - "type": "string", - "enum": [ - "enforce", - "advisory", - "silent", - "declared" - ], - "default": "enforce", - "description": "How the policy named by bundle_hash related to this execution. enforce: evaluated and blocked on deny. advisory: evaluated, logged, allowed. silent: evaluated and enforced with operational logs suppressed; the audit chain still records every would-have-denied decision. declared: the policy is named and bound into the signed record and NOTHING evaluated it, which is the honest value for a producer with no policy engine, such as an agent framework. Gateways MUST default to enforce. A deployment MUST explicitly configure silent. declared is never a default, a producer that evaluates policy MUST NOT use it, and a consumer MUST NOT read it as evidence that any rule was checked." - }, - "version": { - "type": "string", - "description": "Policy bundle version (semantic versioning recommended)." - }, - "policy_uri": { - "type": "string", - "format": "uri", - "description": "URI to the policy bundle for verification." - } - }, - "additionalProperties": false - }, - "data_class": { - "type": "string", - "description": "Highest-sensitivity data classification of inputs and outputs processed during this execution.", - "examples": [ - "public", - "internal", - "confidential", - "restricted", - "top-secret" - ] - }, - "tool_transcript": { - "type": "object", - "description": "Bound hash of the MCP/A2A tool-call transcript. OPTIONAL for Phase 1 records; REQUIRED for Phase 2+.", - "required": [ - "hash" - ], - "properties": { - "hash": { - "type": "string", - "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.", - "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" - }, - "call_count": { - "type": "integer", - "minimum": 0, - "description": "Total number of tool calls in this session." - }, - "transcript_uri": { - "type": "string", - "format": "uri", - "description": "URI to the full transcript on the transparency log." - } - }, - "additionalProperties": false - }, - "delegation": { - "type": "object", - "description": "A2A profile: links this record to the delegating hop's Trust Record. Present when this execution acted on delegated authority; absent on a root (non-delegated) execution. A chain of these forms an offline-verifiable delegation DAG.", - "required": [ - "parent_record_hash", - "credential_id" - ], - "properties": { - "parent_record_hash": { - "type": "string", - "description": "SHA-256 or SHA-384 digest of the parent hop's Trust Record.", - "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" - }, - "credential_id": { - "type": "string", - "minLength": 1, - "description": "Identifier of the delegation credential this hop acted under." - } - }, - "additionalProperties": false - }, - "origin": { - "type": "object", - "description": "Where the evidence in this record came from, when that is not this runtime. Absent means the runtime produced its own record, which is what a consumer assumes and what every hardware profile is. Present means something else assembled the record from evidence it did not measure. A non-self kind cannot carry a hardware runtime.platform.", - "required": [ - "kind", - "producer" - ], - "properties": { - "kind": { - "type": "string", - "enum": [ - "self", - "third-party-control-plane", - "log-import" - ], - "description": "self: the runtime produced its own record. third-party-control-plane: assembled from another vendor's runtime governance output, asserted by the system that produced it with no root outside that system. log-import: assembled from a log or export whose producer is not a control plane." - }, - "producer": { - "type": "string", - "minLength": 1, - "description": "Identifier of the system that produced the source evidence." - }, - "source_event_id": { - "type": "string", - "minLength": 1, - "description": "Identifier of the source event in the producing system, so a record can be traced back to it." - }, - "ingested_at": { - "type": "integer", - "minimum": 1700000000, - "description": "Unix time at which the source evidence was ingested. Distinct from iat, which is when this record was issued." - } - }, - "additionalProperties": false - }, - "build_provenance": { - "type": "object", - "description": "SLSA provenance for the workload (agent code + container image).", - "required": [ - "slsa_level", - "digest" - ], - "properties": { - "slsa_level": { - "type": "integer", - "minimum": 0, - "maximum": 3, - "description": "SLSA Build Level achieved. Level 0 = software-only (development/staging); Level 2 minimum for TRACE conformance; Level 3 for production mark." - }, - "builder": { - "type": "string", - "description": "SLSA builder URI." - }, - "digest": { - "type": "string", - "description": "SHA-256 or SHA-384 digest of the container image or workload binary.", - "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" - }, - "provenance_uri": { - "type": "string", - "format": "uri", - "description": "URI to the SLSA provenance attestation on a Sigstore/Rekor or compatible log." - }, - "provenance_depth": { - "type": "string", - "enum": [ - "surface", - "builder", - "transitive" - ], - "description": "Depth of supply-chain verification the issuer claims for this record. surface: digest matches the workload artifact and builder is in a trusted set. builder: all of surface, plus provenance_uri resolves, the SLSA attestation signature verifies, its subject matches digest, and its builder.id matches builder. transitive: all of builder, plus every entry in the SLSA materials / resolvedDependencies has a verifiable publisher attestation. Records omitting this field are treated as surface by verifiers, so existing records keep their meaning." - } - }, - "additionalProperties": false - }, - "appraisal": { - "type": "object", - "description": "Verifier's EAR appraisal of the evidence (draft-ietf-rats-ar4si).", - "required": [ - "status", - "verifier" - ], - "properties": { - "status": { - "type": "string", - "enum": [ - "affirming", - "warning", - "contraindicated", - "none" - ], - "description": "EAR appraisal status." - }, - "verifier": { - "type": "string", - "format": "uri", - "description": "URI identifying the verifier that produced this appraisal." - }, - "policy_ref": { - "type": "string", - "format": "uri", - "description": "URI to the appraisal policy used." - }, - "timestamp": { - "type": "integer", - "description": "Unix epoch seconds when the appraisal was produced." - }, - "provenance_depth_verified": { - "type": "string", - "enum": [ - "surface", - "builder", - "transitive" - ], - "description": "Depth at which this verifier actually checked build_provenance, which is not necessarily the depth the issuer claimed. A verifier may downgrade when deeper evidence does not resolve, and records the lower depth rather than a failure of the higher one. A verifier does not record a depth higher than it executed." - } - }, - "additionalProperties": false - }, - "transparency": { - "type": "string", - "format": "uri", - "description": "SCITT receipt URI. The Trust Record is the Signed Statement; this URI resolves to the inclusion proof (Receipt) on the transparency log." - }, - "cnf": { - "type": "object", - "description": "Confirmation key (RFC 8747) that binds the Trust Record to the TEE-held signing key.", - "required": [ - "jwk" - ], - "properties": { - "jwk": { - "type": "object", - "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y.", - "required": [ - "kty" - ], - "properties": { - "kty": { - "type": "string" - }, - "crv": { - "type": "string" - }, - "x": { - "type": "string" - }, - "y": { - "type": "string" - }, - "kid": { - "type": "string" - } - }, - "allOf": [ - { - "if": { - "required": [ - "kty" - ], - "properties": { - "kty": { - "const": "OKP" - } - } - }, - "then": { - "required": [ - "crv", - "x" - ] - } - }, - { - "if": { - "required": [ - "kty" - ], - "properties": { - "kty": { - "const": "EC" - } - } - }, - "then": { - "required": [ - "crv", - "x", - "y" - ] - } - } - ], - "not": { - "anyOf": [ - { - "required": [ - "d" - ] - }, - { - "required": [ - "p" - ] - }, - { - "required": [ - "q" - ] - }, - { - "required": [ - "dp" - ] - }, - { - "required": [ - "dq" - ] - }, - { - "required": [ - "qi" - ] - }, - { - "required": [ - "k" - ] - } - ] - }, - "$comment": "RFC 8747 defines cnf as a confirmation key: the public half, present so a verifier can bind the record to the key that signed it. A private member here publishes the signing key inside the signed, self-authenticating, typically anchored record, and the only remedy afterwards is to revoke the identity. Mirrors _JWK_PRIVATE_PARAMS in the reference model, which already refuses these." - } - }, - "additionalProperties": false - }, - "signature": { - "type": "string", - "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with only this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.", - "pattern": "^[A-Za-z0-9_-]+$" - } - }, - "additionalProperties": false, - "allOf": [ - { - "$comment": "A record assembled from another party's evidence has no hardware root. Mirrors the cross-field check in the reference model, so a validator that only reads this schema enforces it too.", - "if": { - "required": [ - "origin" - ], - "properties": { - "origin": { - "required": [ - "kind" - ], - "properties": { - "kind": { - "enum": [ - "third-party-control-plane", - "log-import" - ] - } - } - } - } - }, - "then": { - "properties": { - "runtime": { - "properties": { - "platform": { - "const": "software-only" - } - } - } - } - } - } - ] -} +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://agentrust-io.com/schema/trace-v0.2.json", + "$defs": { + "canonicalizableValue": { + "description": "Any JSON value section 3.2.2 can canonicalize without ambiguity. RFC 7517 lets a JWK carry members this schema does not name, those members are covered by the signature, and they therefore need the constraint the named fields carry: `number` is excluded, and an integer is held to the safe-integer domain. Recursive, because such a member may itself be an array or an object.", + "anyOf": [ + { + "type": [ + "string", + "boolean", + "null" + ] + }, + { + "type": "integer", + "minimum": -9007199254740991, + "maximum": 9007199254740991 + }, + { + "type": "array", + "items": { + "$ref": "#/$defs/canonicalizableValue" + } + }, + { + "type": "object", + "additionalProperties": { + "$ref": "#/$defs/canonicalizableValue" + } + } + ] + } + }, + "title": "TRACE Trust Record", + "description": "A TRACE v0.2 Trust Record: a signed governance record for an AI agent execution, which can carry hardware attestation evidence.", + "type": "object", + "required": [ + "eat_profile", + "iat", + "subject", + "model", + "runtime", + "policy", + "data_class", + "build_provenance", + "appraisal", + "cnf" + ], + "properties": { + "eat_profile": { + "type": "string", + "const": "tag:agentrust-io.com,2026:trace-v0.2", + "description": "EAT profile URI identifying this as a TRACE v0.2 Trust Record." + }, + "iat": { + "type": "integer", + "description": "Issued-at time as Unix epoch seconds.", + "minimum": 1700000000, + "maximum": 9007199254740991 + }, + "subject": { + "type": "string", + "description": "Workload identity as a SPIFFE SVID URI or DID URI. A SPIFFE ID carries a trust domain and a workload path within it; a DID carries a lowercase method name, per DID Core section 3.1, and a method-specific identifier. A prefix alone is not an identity: spiffe://example.org names a trust domain and no workload.", + "pattern": "^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$" + }, + "model": { + "type": "object", + "description": "Model identity and provenance.", + "required": [ + "provider", + "model_id" + ], + "properties": { + "provider": { + "type": "string", + "description": "Model provider (e.g. 'example-provider')." + }, + "model_id": { + "type": "string", + "description": "Model identifier as used by the provider." + }, + "version": { + "type": "string", + "description": "Model version or snapshot identifier." + }, + "weights_digest": { + "type": "string", + "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" + }, + "aibom_uri": { + "type": "string", + "format": "uri", + "description": "URI to SPDX 3.0 AI Profile or CycloneDX 1.7 ML-BOM for this model." + } + }, + "additionalProperties": false + }, + "runtime": { + "type": "object", + "description": "TEE measurement chain binding the workload to hardware.", + "required": [ + "platform", + "measurement" + ], + "properties": { + "platform": { + "type": "string", + "enum": [ + "intel-tdx", + "amd-sev-snp", + "azure-cvm-sev-snp", + "nvidia-h100", + "nvidia-blackwell", + "aws-nitro", + "arm-cca", + "google-confidential-space", + "tpm2", + "software-only" + ], + "description": "Hardware platform providing the root of trust. software-only marks records with no hardware root of trust, for example a development-mode execution, or a record assembled from evidence produced outside the runtime (origin.kind other than self requires this value; see spec 3.1.1). Such records must never be treated as attested evidence." + }, + "measurement": { + "type": "string", + "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" + }, + "rim_uri": { + "type": "string", + "format": "uri", + "description": "URI to the vendor-published Reference Integrity Manifest for this measurement." + }, + "nonce": { + "type": "string", + "description": "Freshness nonce binding the attestation report to this record (base64url, no padding)." + }, + "firmware_version": { + "type": "string", + "description": "Firmware or microcode version included in the measurement." + } + }, + "additionalProperties": false + }, + "policy": { + "type": "object", + "description": "Policy bundle sealed to the TEE measurement.", + "required": [ + "bundle_hash", + "enforcement_mode" + ], + "properties": { + "bundle_hash": { + "type": "string", + "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" + }, + "enforcement_mode": { + "type": "string", + "enum": [ + "enforce", + "advisory", + "silent", + "declared" + ], + "default": "enforce", + "description": "How the policy named by bundle_hash related to this execution. enforce: evaluated and blocked on deny. advisory: evaluated, logged, allowed. silent: evaluated and allowed, including on deny, with operational logs suppressed; the audit chain still records every would-have-denied decision. declared: the policy is named and bound into the signed record and NOTHING evaluated it, which is the honest value for a producer with no policy engine, such as an agent framework. Gateways MUST default to enforce. A deployment MUST explicitly configure silent. declared is never a default, a producer that evaluates policy MUST NOT use it, and a consumer MUST NOT read it as evidence that any rule was checked." + }, + "version": { + "type": "string", + "description": "Policy bundle version (semantic versioning recommended)." + }, + "policy_uri": { + "type": "string", + "format": "uri", + "description": "URI to the policy bundle for verification." + } + }, + "additionalProperties": false + }, + "data_class": { + "type": "string", + "description": "Highest-sensitivity data classification of inputs and outputs processed during this execution.", + "examples": [ + "public", + "internal", + "confidential", + "restricted", + "top-secret" + ] + }, + "tool_transcript": { + "type": "object", + "description": "Bound hash of the MCP/A2A tool-call transcript. OPTIONAL for Phase 1 records; REQUIRED for Phase 2+.", + "required": [ + "hash" + ], + "properties": { + "hash": { + "type": "string", + "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" + }, + "call_count": { + "type": "integer", + "minimum": 0, + "maximum": 9007199254740991, + "description": "Total number of tool calls in this transcript." + }, + "transcript_uri": { + "type": "string", + "format": "uri", + "description": "URI to the full transcript on the transparency log." + } + }, + "additionalProperties": false + }, + "delegation": { + "type": "object", + "description": "A2A profile: links this record to the delegating hop's Trust Record. Present when this execution acted on delegated authority; absent on a root (non-delegated) execution. A chain of these forms an offline-verifiable delegation DAG.", + "required": [ + "parent_record_hash", + "credential_id" + ], + "properties": { + "parent_record_hash": { + "type": "string", + "description": "SHA-256 or SHA-384 digest of the parent hop's Trust Record.", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" + }, + "credential_id": { + "type": "string", + "minLength": 1, + "description": "Identifier of the delegation credential this hop acted under." + } + }, + "additionalProperties": false + }, + "origin": { + "type": "object", + "description": "Where the evidence in this record came from, when that is not this runtime. Absent means the runtime produced its own record, which is what a consumer assumes and what every hardware profile is. Present means something else assembled the record from evidence it did not measure. A non-self kind cannot carry a hardware runtime.platform.", + "required": [ + "kind", + "producer" + ], + "properties": { + "kind": { + "type": "string", + "enum": [ + "self", + "third-party-control-plane", + "log-import" + ], + "description": "self: the runtime produced its own record. third-party-control-plane: assembled from another vendor's runtime governance output, asserted by the system that produced it with no root outside that system. log-import: assembled from a log or export whose producer is not a control plane." + }, + "producer": { + "type": "string", + "minLength": 1, + "description": "Identifier of the system that produced the source evidence." + }, + "source_event_id": { + "type": "string", + "minLength": 1, + "description": "Identifier of the source event in the producing system, so a record can be traced back to it." + }, + "ingested_at": { + "type": "integer", + "minimum": 1700000000, + "maximum": 9007199254740991, + "description": "Unix time at which the source evidence was ingested. Distinct from iat, which is when this record was issued." + } + }, + "additionalProperties": false + }, + "references": { + "type": "array", + "description": "Facts outside this record that it points at. Spec section 3.1.2. An entry is a pointer, not evidence: the signature attests that this record points there, not the truth of what it points at. The block is assurance-neutral and does not affect runtime.platform. Two further rules in 3.1.2 bind verifiers rather than records, so this schema cannot express them: a verifier MUST NOT reject a record because an entry cannot be resolved, and MUST NOT treat a resolved entry as attested evidence.", + "items": { + "type": "object", + "required": [ + "rel", + "id", + "resolver" + ], + "properties": { + "rel": { + "type": "string", + "minLength": 1, + "description": "Relationship type. The registered values are a registry that grows, so this is not a closed set. authorized-intent: an authorization decided before execution, held in another system. approval-outcome: an attributable human approval attached to a step-up or defer decision. behavior-trace: a behavioural record of what the agent did, of which this record is the environment evidence. condition-appraisal: an independent check's finding on whether a stated condition is established by a stated subject, bound to both by digest. observed-effect: a signed record of the state change an observer outside the agent saw over one interval, with the state before and after, the paths observed and the authority change ran under." + }, + "id": { + "type": "string", + "minLength": 1, + "description": "Identifier of the referenced fact within the resolver's system." + }, + "resolver": { + "type": "string", + "minLength": 1, + "description": "Identifier of the party obliged to resolve id. A producer that cannot name one omits the entry. Which identifiers are self-asserted is not decidable from the record, so this constrains the field's presence and not its value." + }, + "retention": { + "type": "string", + "pattern": "^P(\\d+W|(\\d+Y(\\d+M)?(\\d+D)?|\\d+M(\\d+D)?|\\d+D)(T(\\d+H(\\d+M)?(\\d+S)?|\\d+M(\\d+S)?|\\d+S))?|T(\\d+H(\\d+M)?(\\d+S)?|\\d+M(\\d+S)?|\\d+S))$", + "description": "Period for which resolver undertakes to keep id resolvable, as an ISO 8601 duration. An undertaking only: nothing in this specification enforces it." + }, + "digest": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "SHA-256 or SHA-384 digest of the referenced object, when the producer holds it at issue time." + } + }, + "additionalProperties": false + } + }, + "reproducibility": { + "type": "object", + "description": "The claim that re-executing a named deterministic function of the run, the producer's coordination logic, over a pinned input closure yields a transcript whose RFC 8785 canonical digest equals transcript_digest. Spec section 3.1.4. Producer-side: the claim, not its result, which is an appraisal under appraisal.method. The block does not affect runtime.platform, and the record signature covers it. A closure that omits anything which can change the transcript makes the claim malformed rather than weak; that is detected at re-execution, not by this schema.", + "required": [ + "function", + "code_identity", + "input_closure", + "transcript_digest" + ], + "properties": { + "function": { + "type": "string", + "minLength": 1, + "description": "Name under which the implementation at code_identity exposes the deterministic function re-executed. The convention for invoking it is part of the artifact at code_identity, and so content-addressed with it." + }, + "code_identity": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "SHA-256 or SHA-384 digest of the implementation artifact that contains function. It resolves to an artifact a verifier can obtain without the producer. For a producer whose coordination logic ships in the artifact build_provenance names, this is the same value as build_provenance.digest." + }, + "code_resolver": { + "type": "string", + "minLength": 1, + "description": "Where the artifact at code_identity is obtained: the party obliged to retain it, in the sense section 3.1.2 gives resolver. Omitted when the digest alone locates the artifact, as on a package index; present otherwise, since a verifier that cannot obtain the artifact reports not-attempted." + }, + "input_closure": { + "type": "array", + "description": "The complete content-addressed set of everything function reads: the initial configuration and every recorded external interaction, model calls included. An entry the function does not read is surplus and has no effect on the outcome.", + "items": { + "type": "object", + "description": "One content-addressed input of function. The shape section 3.1.2 gives a reference, without rel or retention, since every entry stands in the same relation to the claim, and with digest required on every entry.", + "required": [ + "id", + "digest", + "resolver" + ], + "properties": { + "id": { + "type": "string", + "minLength": 1, + "description": "Identifier of the input within the resolver's system." + }, + "digest": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "SHA-256 or SHA-384 digest of the input. A verifier holds the input only once what it obtained matches this value, which the producer signed." + }, + "resolver": { + "type": "string", + "minLength": 1, + "description": "Identifier of the party obliged to resolve id, in the sense section 3.1.2 gives resolver. A run's closure is run-private by construction, so the producer is an ordinary resolver here; the bar is integrity, not provenance." + } + }, + "additionalProperties": false + } + }, + "transcript_digest": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "SHA-256 or SHA-384 digest, in the algorithm its prefix names, over the RFC 8785 canonical bytes of the transcript function produces when re-executed over input_closure. The transcript is the function's complete output as a JSON value; its shape belongs to the profile or annex that describes the function." + } + }, + "additionalProperties": false + }, + "build_provenance": { + "type": "object", + "description": "SLSA provenance for the workload (agent code + container image).", + "required": [ + "slsa_level", + "digest" + ], + "properties": { + "slsa_level": { + "type": "integer", + "minimum": 0, + "maximum": 3, + "description": "SLSA Build Level achieved. Level 0 = software-only (development/staging); Level 2 minimum for TRACE conformance; Level 3 for production mark." + }, + "builder": { + "type": "string", + "description": "SLSA builder URI." + }, + "digest": { + "type": "string", + "description": "SHA-256 or SHA-384 digest of the container image or workload binary.", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" + }, + "provenance_uri": { + "type": "string", + "format": "uri", + "description": "URI to the SLSA provenance attestation on a Sigstore/Rekor or compatible log." + }, + "provenance_depth": { + "type": "string", + "enum": [ + "surface", + "builder", + "transitive" + ], + "description": "Depth of supply-chain verification the issuer claims for this record. surface: digest matches the workload artifact and builder is in a trusted set. builder: all of surface, plus provenance_uri resolves, the SLSA attestation signature verifies, its subject matches digest, and its builder.id matches builder. transitive: all of builder, plus every entry in the SLSA materials / resolvedDependencies has a verifiable publisher attestation. Records omitting this field are treated as surface by verifiers, so existing records keep their meaning." + } + }, + "additionalProperties": false + }, + "appraisal": { + "type": "object", + "description": "Verifier's EAR appraisal of the evidence (draft-ietf-rats-ar4si).", + "required": [ + "status", + "verifier" + ], + "properties": { + "status": { + "type": "string", + "enum": [ + "affirming", + "warning", + "contraindicated", + "none" + ], + "description": "EAR appraisal status." + }, + "verifier": { + "type": "string", + "format": "uri", + "description": "URI identifying the verifier the record names for this appraisal. In a record signed only by its producer this is the producer's claim, not authenticated by that verifier." + }, + "policy_ref": { + "type": "string", + "format": "uri", + "description": "URI to the appraisal policy used." + }, + "timestamp": { + "type": "integer", + "minimum": -9007199254740991, + "maximum": 9007199254740991, + "description": "Unix epoch seconds when the appraisal was produced." + }, + "provenance_depth_verified": { + "type": "string", + "enum": [ + "surface", + "builder", + "transitive" + ], + "description": "Depth at which this verifier actually checked build_provenance, which is not necessarily the depth the issuer claimed. A verifier may downgrade when deeper evidence does not resolve, and records the lower depth rather than a failure of the higher one. A verifier does not record a depth higher than it executed." + }, + "method": { + "type": "string", + "enum": [ + "re-execution" + ], + "description": "The method this appraisal used. A closed set, for the reason section 3.1.1 gives origin.kind: a verifier keys on it. This version defines one value, re-execution, the result of re-running a record's reproducibility claim (section 3.1.4). appraisal.status is untouched by it: the outcome below is not folded into the EAR status." + }, + "re_execution": { + "type": "object", + "description": "The re-execution result, attributed to the party that re-ran the function and named as appraisal.verifier. In a record signed only by its producer this attribution is the producer's report, not authenticated by the verifier. Spec section 3.1.4. Present exactly when method is re-execution.", + "required": [ + "outcome" + ], + "properties": { + "outcome": { + "type": "string", + "enum": [ + "reproduced", + "diverged", + "not-attempted" + ], + "description": "reproduced: the re-run completed on the closure alone and the digest of its transcript equals transcript_digest. diverged: the re-run completed on the closure alone and the digests differ. not-attempted: a closure blob could not be resolved, code_identity could not be obtained, the function read beyond the closure, the re-run did not run to completion, or the verifier could not establish that the re-run used the closure alone. not-attempted is never reported as either of the other two: absent is not pass, and absent is not failure." + }, + "observed_digest": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "The verifier's digest of the transcript its re-run produced. Required when outcome is diverged, because divergence localises nothing by itself: producer tampering, a function that is not the deterministic one it is named as, and verifier drift are indistinguishable until a third party can compare transcripts." + }, + "reason": { + "type": "string", + "minLength": 1, + "description": "Why no outcome could be reported. Required when outcome is not-attempted: a named absence and a generic one are different findings, and this is where the finding is kept." + }, + "verifier_code_identity": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "Digest of the verifier's own implementation. Self-asserted and carrying no weight singly; a correlation key across results, since two verifiers at different implementations disagreeing over the same closure is verifier drift, and that reading is unavailable without it." + } + }, + "allOf": [ + { + "$comment": "Divergence without the observed digest cannot be compared by anyone.", + "if": { + "required": [ + "outcome" + ], + "properties": { + "outcome": { + "const": "diverged" + } + } + }, + "then": { + "required": [ + "observed_digest" + ] + } + }, + { + "$comment": "An inability to check is reported with its cause, never rounded to an outcome.", + "if": { + "required": [ + "outcome" + ], + "properties": { + "outcome": { + "const": "not-attempted" + } + } + }, + "then": { + "required": [ + "reason" + ] + } + } + ], + "additionalProperties": false + }, + "platform_measurement": { + "type": "object", + "description": "Per-layer appraisal of the platform measurement, attributed to appraisal.verifier. In a record signed only by its producer this attribution is the producer's report. A member of appraisal in its own right, not an appraisal.method value, so it can sit next to a re-execution result. measurement must equal runtime.measurement, a cross-field rule the reference model enforces. Spec section 3.1.5.", + "required": [ + "measurement", + "layers" + ], + "properties": { + "measurement": { + "type": "string", + "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", + "description": "The digest this appraisal is about. Must equal runtime.measurement: a result about another measurement is not about this record." + }, + "layers": { + "type": "object", + "minProperties": 1, + "description": "Keyed by the platform's name for the layer; on tpm2, pcr: followed by a register number from 0 to 23 in decimal without leading zeros. A result naming no layer establishes nothing.", + "additionalProperties": { + "type": "object", + "description": "One layer's outcome. Spec section 3.1.5. reason is required when outcome is not-established and absent when it is established.", + "required": [ + "outcome" + ], + "properties": { + "outcome": { + "type": "string", + "enum": [ + "established", + "not-established" + ], + "description": "established: the evidence establishes this layer. not-established: it does not, for the reason given; never reported as established, and a layer the result does not list is not established either." + }, + "reason": { + "type": "string", + "enum": [ + "layer-not-measured", + "measured-not-appraised", + "evidence-spans-multiple-boots" + ], + "description": "layer-not-measured: the layer holds no measurement, its value is the initial value or, on a TPM, a separator and nothing else. measured-not-appraised: the measurements replay to the quoted value and nothing in the evidence establishes that what ran was appraised before it ran. evidence-spans-multiple-boots: the evidence does not establish that the quote and the event log describe the same single boot, and the log does not replay to the quoted value." + } + }, + "allOf": [ + { + "$comment": "A not-established layer carries its reason; an established one carries none.", + "if": { + "required": [ + "outcome" + ], + "properties": { + "outcome": { + "const": "not-established" + } + } + }, + "then": { + "required": [ + "reason" + ] + }, + "else": { + "not": { + "required": [ + "reason" + ] + } + } + } + ], + "additionalProperties": false + } + } + }, + "additionalProperties": false + } + }, + "allOf": [ + { + "$comment": "Section 3.1.4: re_execution is present when method is re-execution and absent otherwise. Mirrors the cross-field check in the reference model.", + "if": { + "required": [ + "method" + ], + "properties": { + "method": { + "const": "re-execution" + } + } + }, + "then": { + "required": [ + "re_execution" + ] + }, + "else": { + "not": { + "required": [ + "re_execution" + ] + } + } + }, + { + "$comment": "Section 3.1.5, rule 5: a verifier that writes platform_measurement has performed an appraisal, so status is not none. Mirrors the check in the reference model.", + "if": { + "required": [ + "platform_measurement" + ] + }, + "then": { + "properties": { + "status": { + "not": { + "const": "none" + } + } + } + } + } + ], + "additionalProperties": false + }, + "transparency": { + "type": "string", + "format": "uri", + "description": "SCITT receipt URI. The Trust Record is the Signed Statement; this URI resolves to the inclusion proof (Receipt) on the transparency log." + }, + "cnf": { + "type": "object", + "description": "Confirmation key (RFC 8747) that binds the Trust Record to the TEE-held signing key.", + "required": [ + "jwk" + ], + "properties": { + "jwk": { + "type": "object", + "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y; RSA keys require n and e.", + "required": [ + "kty" + ], + "properties": { + "kty": { + "type": "string" + }, + "crv": { + "type": "string" + }, + "x": { + "type": "string" + }, + "y": { + "type": "string" + }, + "n": { + "type": "string" + }, + "e": { + "type": "string" + }, + "kid": { + "type": "string" + } + }, + "allOf": [ + { + "if": { + "required": [ + "kty" + ], + "properties": { + "kty": { + "const": "OKP" + } + } + }, + "then": { + "required": [ + "crv", + "x" + ] + } + }, + { + "if": { + "required": [ + "kty" + ], + "properties": { + "kty": { + "const": "EC" + } + } + }, + "then": { + "required": [ + "crv", + "x", + "y" + ] + } + }, + { + "if": { + "required": [ + "kty" + ], + "properties": { + "kty": { + "const": "RSA" + } + } + }, + "then": { + "required": [ + "n", + "e" + ] + } + } + ], + "not": { + "anyOf": [ + { + "required": [ + "d" + ] + }, + { + "required": [ + "p" + ] + }, + { + "required": [ + "q" + ] + }, + { + "required": [ + "dp" + ] + }, + { + "required": [ + "dq" + ] + }, + { + "required": [ + "qi" + ] + }, + { + "required": [ + "k" + ] + } + ] + }, + "$comment": "RFC 8747 defines cnf as a confirmation key: the public half, present so a verifier can bind the record to the key that signed it. A private member here publishes the signing key inside the signed, self-authenticating, typically anchored record, and the only remedy afterwards is to revoke the identity. Mirrors _JWK_PRIVATE_PARAMS in the reference model, which already refuses these. A kty this schema does not name is not held to a key-material rule here: section 3.2.1 states signing algorithms per envelope context and fixes no set for the embedded-signature form of section 3.2.2, so an enum here would add a constraint the specification does not make, and such a key is refused later by the verifier. The n and e declarations are load-bearing rather than decorative: without them a non-string modulus reaches additionalProperties, which admits any canonicalizable value.", + "additionalProperties": { + "$ref": "#/$defs/canonicalizableValue" + } + } + }, + "additionalProperties": false + }, + "signature": { + "type": "string", + "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with only this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema. An 86-character value is the base64url encoding of a 64-byte signature (Ed25519 or ES256) and MUST be canonically encoded per RFC 4648 section 3.5: its final character's unused bits MUST be zero, so it MUST end in A, Q, g, or w.", + "pattern": "^(?:[A-Za-z0-9_-]{1,85}|[A-Za-z0-9_-]{85}[AQgw]|[A-Za-z0-9_-]{87,})$" + } + }, + "additionalProperties": false, + "allOf": [ + { + "$comment": "A record assembled from another party's evidence has no hardware root. Mirrors the cross-field check in the reference model, so a validator that only reads this schema enforces it too.", + "if": { + "required": [ + "origin" + ], + "properties": { + "origin": { + "required": [ + "kind" + ], + "properties": { + "kind": { + "enum": [ + "third-party-control-plane", + "log-import" + ] + } + } + } + } + }, + "then": { + "properties": { + "runtime": { + "properties": { + "platform": { + "const": "software-only" + } + } + } + } + } + }, + { + "$comment": "Section 3.1.5: on a TPM a layer is named pcr: and a register number from 0 to 23, in decimal without leading zeros. Mirrors the layer-name check in the reference model.", + "if": { + "required": [ + "runtime", + "appraisal" + ], + "properties": { + "runtime": { + "required": [ + "platform" + ], + "properties": { + "platform": { + "const": "tpm2" + } + } + }, + "appraisal": { + "required": [ + "platform_measurement" + ] + } + } + }, + "then": { + "properties": { + "appraisal": { + "properties": { + "platform_measurement": { + "properties": { + "layers": { + "propertyNames": { + "pattern": "^pcr:([0-9]|1[0-9]|2[0-3])$" + } + } + } + } + } + } + } + } + } + ] +} diff --git a/conformance/tests/test_digest_parity.py b/conformance/tests/test_digest_parity.py index 251b665e..2dd341b3 100644 --- a/conformance/tests/test_digest_parity.py +++ b/conformance/tests/test_digest_parity.py @@ -1,32 +1,32 @@ """Every copy of the digest-format pattern, compared against the schema. -The string `^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$` exists in eleven places: -six `pattern` values in `schemas/trace-claim.json` and five compiled constants -in the modules and the tests. Eleven copies of one rule, and changing any one of +The string `^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$` exists in eighteen places: +thirteen `pattern` values in `schemas/trace-claim.json` and five compiled constants +in the modules and the tests. Eighteen copies of one rule, and changing any one of them is a silent change to what the suite accepts. `test_enum_parity.py` is the same guard for the hand-written enums. `measurement/scripts/enum_drift.py` is what discovers an unknown copy, but it finds them by walking the AST for a set of string constants, so a compiled regex -is invisible to it by construction. That is why these eleven were unguarded +is invisible to it by construction. That is why these eighteen were unguarded while the five enum copies were not. The schema sites are named here rather than discovered, and a walk checks the -list against the schema: a seventh digest field appearing in the schema fails +list against the schema: a fourteenth digest field appearing in the schema fails `test_no_digest_site_in_the_schema_is_missing_from_the_list` instead of joining silently. The list stays named, so adding a site is still a decision; it just cannot be skipped, and a listed entry naming no schema site fails from the other side. The compiled copies get no such walk. `enum_drift.py` cannot see a compiled -regex and neither can a walk of the schema, so nothing discovers a twelfth +regex and neither can a walk of the schema, so nothing discovers a sixth compiled copy; `assert len(COMPILED_COPIES) == 5` marks that boundary rather than closing it. That gap is stated here because the schema half no longer shares it. Near misses, deliberately not listed: src/trace_tests/inclusion.py and tests/test_report.py each pin a sha256-only pattern. That is a -narrower rule than this one, not a twelfth copy of it. +narrower rule than this one, not an additional copy of it. """ from __future__ import annotations @@ -43,13 +43,20 @@ # than searched for. A new digest-shaped field is a decision about what this # suite pins, so it joins this list deliberately or fails # `test_every_known_site_is_listed`. -SCHEMA_SITES = [ +SCHEMA_SITES: list[tuple[str, ...]] = [ ("model", "weights_digest"), ("runtime", "measurement"), ("policy", "bundle_hash"), ("tool_transcript", "hash"), ("delegation", "parent_record_hash"), + ("references", "items", "digest"), + ("reproducibility", "code_identity"), + ("reproducibility", "input_closure", "items", "digest"), + ("reproducibility", "transcript_digest"), ("build_provenance", "digest"), + ("appraisal", "re_execution", "observed_digest"), + ("appraisal", "re_execution", "verifier_code_identity"), + ("appraisal", "platform_measurement", "measurement"), ] # (label, the compiled copy). Lambdas for the same reason `test_enum_parity.py` @@ -63,14 +70,17 @@ ] -def _schema_pattern(schema: dict, parent: str, child: str) -> str: - return str(schema["properties"][parent]["properties"][child]["pattern"]) +def _schema_pattern(schema: dict, *path: str) -> str: + node = schema + for step in path: + node = node["items"] if step == "items" else node["properties"][step] + return str(node["pattern"]) def _reference(schema: dict) -> str: """The pattern the compiled copies are held to. - Any of the six would serve; `test_every_schema_digest_site_holds_one_pattern` + Any of the thirteen would serve; `test_every_schema_digest_site_holds_one_pattern` is what makes the choice arbitrary rather than load-bearing. Drift in this particular site therefore reds the copy cases too, which is true rather than noisy: the string they are all held to is the one that moved. @@ -79,16 +89,16 @@ def _reference(schema: dict) -> str: def test_every_schema_digest_site_holds_one_pattern(schema) -> None: - """The six schema copies, against each other. + """The thirteen schema copies, against each other. Grouped rather than compared pairwise so the failure says which sites hold which string, instead of naming one site and leaving the reader to find its partner. """ by_pattern: dict[str, list[str]] = {} - for parent, child in SCHEMA_SITES: - site = f"{parent}.{child}" - by_pattern.setdefault(_schema_pattern(schema, parent, child), []).append(site) + for path in SCHEMA_SITES: + site = ".".join(path) + by_pattern.setdefault(_schema_pattern(schema, *path), []).append(site) assert len(by_pattern) == 1, "the schema's digest patterns have drifted apart\n" + "\n".join( f" {pattern!r}\n {', '.join(sites)}" for pattern, sites in sorted(by_pattern.items()) @@ -116,21 +126,26 @@ def test_a_compiled_digest_copy_matches_the_schema(label, get_copy, schema) -> N def test_no_digest_site_in_the_schema_is_missing_from_the_list(schema) -> None: - walked: set[tuple[str, str]] = set() + walked: set[tuple[str, ...]] = set() - def visit(node: object, parent: str | None, key: str | None) -> None: + def visit(node: object, path: tuple[str, ...]) -> None: if isinstance(node, dict): pattern = node.get("pattern") - if isinstance(pattern, str) and pattern.startswith("^sha") and parent and key: - walked.add((parent, key)) + if isinstance(pattern, str) and pattern.startswith("^sha") and path: + walked.add(path) for name, value in node.items(): if name == "properties" and isinstance(value, dict): for child, sub in value.items(): - visit(sub, key, child) + visit(sub, (*path, child)) + elif name == "items": + visit(value, (*path, "items")) else: - visit(value, parent, key) + visit(value, path) + elif isinstance(node, list): + for item in node: + visit(item, path) - visit(schema, None, None) + visit(schema, ()) assert walked == set(SCHEMA_SITES), ( "the schema's digest-shaped fields and SCHEMA_SITES disagree\n" f" in the schema, not listed: {sorted(walked - set(SCHEMA_SITES))}\n" diff --git a/conformance/tests/test_docs_match_the_modules.py b/conformance/tests/test_docs_match_the_modules.py index 7230be43..30534214 100644 --- a/conformance/tests/test_docs_match_the_modules.py +++ b/conformance/tests/test_docs_match_the_modules.py @@ -299,3 +299,41 @@ def test_the_registration_table_and_the_published_table_agree() -> None: "no unverified-level row was parsed, so this check would pass over no " "work; the table in docs/levels.md is gone or its shape changed" ) + + +def test_digest_docs_name_both_sha256_and_sha384() -> None: + """Every digest check accepts both sha256: and sha384:; the docs must say so (#448 item 5).""" + error_codes_text = ERROR_CODES.read_text(encoding="utf-8") + for code in ("TR-RTE-002", "TR-POL-001", "TR-TXN-001", "TR-SCA-002"): + row = next( + (line for line in error_codes_text.splitlines() if line.startswith(f"| {code} ")), + None, + ) + assert row is not None, f"missing row for {code} in {ERROR_CODES.relative_to(REPO)}" + assert "sha256:" in row and "sha384:" in row, ( + f"{code} row in {ERROR_CODES.relative_to(REPO)} must name both sha256: and sha384:" + ) + + for page_name, code in ( + ("tr-rte.md", "TR-RTE-002"), + ("tr-pol.md", "TR-POL-001"), + ("tr-txn.md", "TR-TXN-001"), + ("tr-sca.md", "TR-SCA-002"), + ): + page_text = (DOCS / "modules" / page_name).read_text(encoding="utf-8") + row = next( + (line for line in page_text.splitlines() if line.startswith(f"| {code} ")), + None, + ) + assert row is not None, f"missing row for {code} in docs/modules/{page_name}" + assert "sha256:" in row and "sha384:" in row, ( + f"{code} row in docs/modules/{page_name} must name both sha256: and sha384:" + ) + + +def test_levels_doc_agrees_with_tr_rte_on_all_zero_measurements() -> None: + """TR-RTE-002 is format-only; docs/levels.md must not claim it rejects all-zero (#448).""" + levels_text = LEVELS.read_text(encoding="utf-8") + assert "measurement must be non-zero" not in levels_text.lower() + assert "all-zero is invalid at level 1" not in levels_text.lower() + diff --git a/conformance/tests/test_packaged_schema_accepts_real_records.py b/conformance/tests/test_packaged_schema_accepts_real_records.py index 55c8a9e4..363325d4 100644 --- a/conformance/tests/test_packaged_schema_accepts_real_records.py +++ b/conformance/tests/test_packaged_schema_accepts_real_records.py @@ -2,8 +2,8 @@ The packaged copy sat at `$id` `trace-v0.1.json` while the normative schema moved to v0.2, and the two diverged on two top-level properties: `signature` and -`delegation`. With `additionalProperties: false` — which -`test_unknown_fields_rejected` shows is deliberate — the packaged copy therefore +`delegation`. With `additionalProperties: false` (which +`test_unknown_fields_rejected` shows is deliberate), the packaged copy therefore rejected **every signed record**, which is every real one, and every delegated record twice over. @@ -17,7 +17,7 @@ The two vectors are copied from trace-spec's `examples/delegation-link/`, which is generated from a published seed and reproducible by anyone. Nothing here compares -them to the originals — a guard that needs another repository checked out is a +them to the originals: a guard that needs another repository checked out is a guard that gets skipped. They are held instead to the property that makes them worth having: they carry the fields whose absence hid the defect. A vector edited into something unsigned stops being a regression test loudly rather than quietly. @@ -25,9 +25,16 @@ from __future__ import annotations +import copy +import pathlib + import jsonschema import pytest +CONFORMANCE_ROOT = pathlib.Path(__file__).resolve().parents[1] +PACKAGED_SCHEMA_PATH = CONFORMANCE_ROOT / "schemas" / "trace-claim.json" +NORMATIVE_SCHEMA_PATH = CONFORMANCE_ROOT.parent / "schema" / "trace-claim.json" + @pytest.mark.level0 class TestPackagedSchemaAcceptsRealRecords: @@ -59,3 +66,108 @@ def test_the_packaged_schema_declares_the_version_it_is(self, schema): f"packaged schema declares {schema['$id']}, which is not the version " "the records it validates say they are" ) + + def test_packaged_schema_is_byte_identical_to_normative_schema(self): + """In the consolidated repository, `conformance/schemas/trace-claim.json` + must be byte-identical to `schema/trace-claim.json` (#515).""" + if not NORMATIVE_SCHEMA_PATH.is_file(): + pytest.skip("standalone checkout without ../schema/trace-claim.json") + assert PACKAGED_SCHEMA_PATH.read_bytes() == NORMATIVE_SCHEMA_PATH.read_bytes(), ( + "conformance/schemas/trace-claim.json has drifted from schema/trace-claim.json" + ) + + def test_v02_record_with_references_reproducibility_and_appraisal_extensions_validates( + self, schema, signed_root + ): + """Records carrying sections 3.1.2, 3.1.4, and 3.1.5 fields must validate (#515).""" + record = copy.deepcopy(signed_root) + record["references"] = [ + { + "rel": "behavior-trace", + "id": "run-1", + "resolver": "https://agt.example.org", + "digest": "sha256:" + "f" * 64, + "retention": "P30D", + } + ] + record["reproducibility"] = { + "function": "coordination/v1", + "code_identity": "sha256:" + "1" * 64, + "code_resolver": "https://artifacts.example.org", + "input_closure": [ + { + "id": "config/initial", + "digest": "sha256:" + "2" * 64, + "resolver": "https://artifacts.example.org", + } + ], + "transcript_digest": "sha256:" + "3" * 64, + } + record["appraisal"] = { + "status": "contraindicated", + "verifier": "https://verifier.example/v1", + "method": "re-execution", + "re_execution": { + "outcome": "diverged", + "observed_digest": "sha256:" + "4" * 64, + "verifier_code_identity": "sha256:" + "5" * 64, + }, + "platform_measurement": { + "measurement": record["runtime"]["measurement"], + "layers": { + "pcr:0": {"outcome": "established"}, + "pcr:2": { + "outcome": "not-established", + "reason": "layer-not-measured", + }, + }, + }, + } + jsonschema.validate(record, schema) + + def test_cnf_jwk_accepts_canonicalizable_extensions_and_rejects_non_canonicalizable_numbers( + self, schema, signed_root + ): + """cnf.jwk uses $defs/canonicalizableValue (#448 item 2): RFC 7517 extension + members with canonicalizable values validate, while floats and unsafe integers + are rejected.""" + valid_ext = copy.deepcopy(signed_root) + valid_ext["cnf"]["jwk"]["use"] = "sig" + valid_ext["cnf"]["jwk"]["key_ops"] = ["verify"] + jsonschema.validate(valid_ext, schema) + + for bad_number in (1e21, 1.5, 9007199254740992): + invalid_ext = copy.deepcopy(signed_root) + invalid_ext["cnf"]["jwk"]["ext"] = bad_number + with pytest.raises(jsonschema.ValidationError): + jsonschema.validate(invalid_ext, schema) + + @pytest.mark.parametrize( + ("mutator", "reason"), + [ + ( + lambda r: r.__setitem__("subject", "spiffe://bernstein.run"), + "SPIFFE prefix without workload path", + ), + ( + lambda r: r.__setitem__("iat", 9007199254740992), + "iat above IEEE 754 MAX_SAFE_INTEGER", + ), + ( + lambda r: r.__setitem__("signature", "A" * 85 + "B"), + "non-canonical 86-char base64url signature", + ), + ( + lambda r: r["cnf"].__setitem__("jwk", {"kty": "RSA"}), + "RSA cnf.jwk missing required n and e members", + ), + ], + ) + def test_packaged_schema_rejects_records_forbidden_by_normative_schema( + self, schema, signed_root, mutator, reason + ): + record = copy.deepcopy(signed_root) + mutator(record) + with pytest.raises(jsonschema.ValidationError, match="."): + jsonschema.validate(record, schema) +