From 128ec83c31e1633cf6e49c1efa65314815240a1f Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 27 Jul 2026 21:34:28 -0700 Subject: [PATCH 1/2] chore: move docs and catalogs to TRACE v0.2; hold recorded records at v0.1 Documentation, the ARD catalogs, and the policy manifests move to the v0.2 profile and to agentrust-io.com. Nothing signs those, so the change is free. The recorded trust records do not move. Eleven of them carry a real Ed25519 signature over a payload that includes the profile URI, and the signing keys are deliberately not committed. Rewriting the string while keeping the old signature would produce a record that fails verification: an artifact claiming v0.2 that no v0.2 verifier accepts. These examples exist to demonstrate verifiable evidence, so a record that does not verify is a worse outcome than one that is honestly a version behind. The three unsigned trust records were held back with them so the recorded corpus stays internally consistent rather than half-migrated. TRACE-VERSION-NOTE.md explains the split and how to regenerate. Co-Authored-By: Claude Opus 5 (1M context) --- TRACE-VERSION-NOTE.md | 37 +++++++++++++++ ards/README.md | 24 +++++----- ards/ai-catalog.json | 50 ++++++++++----------- industrial-embodied-ai/catalog.json | 4 +- industrial-embodied-ai/policy/manifest.json | 2 +- 5 files changed, 77 insertions(+), 40 deletions(-) create mode 100644 TRACE-VERSION-NOTE.md diff --git a/TRACE-VERSION-NOTE.md b/TRACE-VERSION-NOTE.md new file mode 100644 index 0000000..c3327cb --- /dev/null +++ b/TRACE-VERSION-NOTE.md @@ -0,0 +1,37 @@ +# The recorded trust records here are TRACE v0.1 + +Every `*/trace-output/*.json` in this repository, plus +`industrial-embodied-ai/agent-manifest.json`, is the recorded output of a demo run +that happened while the stack emitted **TRACE v0.1**, carrying the profile URI +`tag:agentrust.io,2026:trace-v0.1`. + +The stack now emits **v0.2** (`tag:agentrust-io.com,2026:trace-v0.2`). The v0.1 +profile URI named a domain this project never controlled, which RFC 4151 does not +permit for a tag URI. See [trace-spec#107](https://github.com/agentrust-io/trace-spec/pull/107). + +## Why these were not rewritten + +Eleven of them carry a real Ed25519 signature over the record, and the profile URI +sits inside the signed payload. Editing the string while keeping the old signature +would produce a record that **fails verification**: an artifact claiming v0.2 that +no v0.2 verifier would accept. These examples exist to demonstrate verifiable +evidence, so shipping a record that does not verify is worse than shipping one that +is honestly a version behind. + +The signing keys are deliberately not committed, so they cannot be re-signed here. + +Three further records carry no signature +(`healthcare/{sg-moh,uk-nhs,us-fda-samd}`). Those were held back too, so the +recorded corpus stays internally consistent rather than half-migrated. + +## What to do instead + +Regenerate them by re-running the examples against the current stack +(`agentrust-trace>=0.5`, cMCP on the v0.2 profile). The regenerated records will +carry the v0.2 profile with a signature that covers it. + +Until then, read them as what they are: evidence of runs that happened under v0.1, +still verifiable with `agentrust-trace-tests` 0.3.x. + +Documentation, catalogs, and policy manifests in this repository **have** moved to +v0.2 and to `agentrust-io.com`, since nothing signs those. diff --git a/ards/README.md b/ards/README.md index 4f536be..37871a8 100644 --- a/ards/README.md +++ b/ards/README.md @@ -1,12 +1,12 @@ # ARDS — Governed Agent Discovery -This directory shows how agentrust.io participates in the [Agentic Resource Discovery Specification](https://github.com/ards-project/ard-spec) (ARDS v0.9) as a **governed-agent federated registry** — a specialized ARD registry that only indexes agents carrying TRACE-v0.2 runtime governance attestations. +This directory shows how agentrust-io.com participates in the [Agentic Resource Discovery Specification](https://github.com/ards-project/ard-spec) (ARDS v0.9) as a **governed-agent federated registry** — a specialized ARD registry that only indexes agents carrying TRACE-v0.2 runtime governance attestations. ## What's here | File | Description | |---|---| -| `ai-catalog.json` | agentrust.io's `/.well-known/ai-catalog.json` — the static catalog that ARD crawlers ingest. Lists cMCP, Agent Manifest SDK, and TRACE Registry as governed MCP servers, plus the agentrust.io registry entry for ARD federation. | +| `ai-catalog.json` | agentrust-io.com's `/.well-known/ai-catalog.json` — the static catalog that ARD crawlers ingest. Lists cMCP, Agent Manifest SDK, and TRACE Registry as governed MCP servers, plus the agentrust-io.com registry entry for ARD federation. | ## The integration point @@ -15,13 +15,13 @@ ARDS `trustManifest.attestations` accepts any attestation type. TRACE-v0.2 is a ```json { "trustManifest": { - "identity": "spiffe://trust.agentrust.io/gateway/cmcp/prod", + "identity": "spiffe://trust.agentrust-io.com/gateway/cmcp/prod", "identityType": "spiffe", "attestations": [ - { "type": "SPIFFE-X509", "uri": "https://agentrust.io/.well-known/spiffe/jwks" }, + { "type": "SPIFFE-X509", "uri": "https://agentrust-io.com/.well-known/spiffe/jwks" }, { "type": "TRACE-v0.2", - "uri": "https://trace.agentrust.io/records/cmcp-prod-latest", + "uri": "https://trace.agentrust-io.com/records/cmcp-prod-latest", "digest": "sha256:3f4a8b2c..." } ] @@ -29,11 +29,11 @@ ARDS `trustManifest.attestations` accepts any attestation type. TRACE-v0.2 is a } ``` -The `uri` resolves to a TRACE Trust Record — an EAT (RFC 9711) signed JSON artifact containing the Cedar policy hash, TEE measurement, and tool transcript hash. The `digest` is the SHA-256 of that record. Both fields allow an ARD registry or orchestrator to verify the governance claim offline, without calling agentrust.io. +The `uri` resolves to a TRACE Trust Record — an EAT (RFC 9711) signed JSON artifact containing the Cedar policy hash, TEE measurement, and tool transcript hash. The `digest` is the SHA-256 of that record. Both fields allow an ARD registry or orchestrator to verify the governance claim offline, without calling agentrust-io.com. ## Filtering for governed agents in ARD search -Any ARD registry that ingests the agentrust.io catalog will make this filter work: +Any ARD registry that ingests the agentrust-io.com catalog will make this filter work: ```json { @@ -48,19 +48,19 @@ Any ARD registry that ingests the agentrust.io catalog will make this filter wor This returns only agents with hardware-verifiable runtime governance records — across any registry in the federation that has ingested TRACE-attested entries. -## agentrust.io as a federated governed-agent registry +## agentrust-io.com as a federated governed-agent registry -The last entry in `ai-catalog.json` registers the agentrust.io registry itself: +The last entry in `ai-catalog.json` registers the agentrust-io.com registry itself: ```json { - "identifier": "urn:ai:agentrust.io:registry:governed-agents", + "identifier": "urn:ai:agentrust-io.com:registry:governed-agents", "type": "application/ai-registry+json", - "url": "https://registry.agentrust.io/api/v1/" + "url": "https://registry.agentrust-io.com/api/v1/" } ``` -ARD registries discovering this entry can route queries with `trustManifest.attestations.type: TRACE-v0.2` to `registry.agentrust.io` via federation referrals, delegating governed-agent discovery without replicating the trust logic. +ARD registries discovering this entry can route queries with `trustManifest.attestations.type: TRACE-v0.2` to `registry.agentrust-io.com` via federation referrals, delegating governed-agent discovery without replicating the trust logic. ## TRACE spec diff --git a/ards/ai-catalog.json b/ards/ai-catalog.json index a7911d9..e177ccc 100644 --- a/ards/ai-catalog.json +++ b/ards/ai-catalog.json @@ -1,104 +1,104 @@ { - "$comment": "Reference: agentrust.io governed-agent catalog. All entries carry TRACE-v0.2 runtime governance attestations alongside SPIFFE X.509 identity.", + "$comment": "Reference: agentrust-io.com governed-agent catalog. All entries carry TRACE-v0.2 runtime governance attestations alongside SPIFFE X.509 identity.", "specVersion": "1.0", "host": { - "displayName": "agentrust.io", - "identifier": "agentrust.io", - "documentationUrl": "https://agentrust.io/docs", - "logoUrl": "https://agentrust.io/assets/logo.svg", + "displayName": "agentrust-io.com", + "identifier": "agentrust-io.com", + "documentationUrl": "https://agentrust-io.com/docs", + "logoUrl": "https://agentrust-io.com/assets/logo.svg", "trustManifest": { - "identity": "spiffe://trust.agentrust.io/registry/global", + "identity": "spiffe://trust.agentrust-io.com/registry/global", "identityType": "spiffe", "attestations": [ { "type": "SPIFFE-X509", - "uri": "https://agentrust.io/.well-known/spiffe/jwks" + "uri": "https://agentrust-io.com/.well-known/spiffe/jwks" } ] } }, "entries": [ { - "identifier": "urn:ai:agentrust.io:governed:cmcp-gateway", + "identifier": "urn:ai:agentrust-io.com:governed:cmcp-gateway", "displayName": "Confidential MCP Gateway (cMCP)", "description": "Hardware-attested policy enforcement gateway for MCP tool calls. Cedar policies evaluated inside AMD SEV-SNP / Intel TDX TEE. Every session produces a TRACE Trust Record independently verifiable offline.", "type": "application/mcp-server+json", - "url": "https://api.agentrust.io/mcp/cmcp", + "url": "https://api.agentrust-io.com/mcp/cmcp", "version": "0.2.0", "tags": ["governance", "confidential-computing", "policy-enforcement", "mcp", "tee"], "capabilities": ["PolicyEnforcement", "HardwareAttestation", "AuditLog", "TRACE"], "trustManifest": { - "identity": "spiffe://trust.agentrust.io/gateway/cmcp/prod", + "identity": "spiffe://trust.agentrust-io.com/gateway/cmcp/prod", "identityType": "spiffe", "attestations": [ { "type": "SPIFFE-X509", - "uri": "https://agentrust.io/.well-known/spiffe/jwks" + "uri": "https://agentrust-io.com/.well-known/spiffe/jwks" }, { "type": "TRACE-v0.2", - "uri": "https://trace.agentrust.io/records/cmcp-prod-latest", + "uri": "https://trace.agentrust-io.com/records/cmcp-prod-latest", "digest": "sha256:3f4a8b2c1d9e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2" } ] } }, { - "identifier": "urn:ai:agentrust.io:governed:agent-manifest", + "identifier": "urn:ai:agentrust-io.com:governed:agent-manifest", "displayName": "Agent Manifest SDK", "description": "Hardware-anchors all 10 artifacts defining an agent at deployment. Attestation extended to agents — attested at registration and re-attested on any change.", "type": "application/mcp-server+json", - "url": "https://api.agentrust.io/mcp/agent-manifest", + "url": "https://api.agentrust-io.com/mcp/agent-manifest", "version": "0.1.0", "tags": ["governance", "identity", "attestation", "agent-manifest"], "capabilities": ["AgentIdentity", "HardwareAttestation", "ManifestVerification"], "trustManifest": { - "identity": "spiffe://trust.agentrust.io/service/agent-manifest/prod", + "identity": "spiffe://trust.agentrust-io.com/service/agent-manifest/prod", "identityType": "spiffe", "attestations": [ { "type": "SPIFFE-X509", - "uri": "https://agentrust.io/.well-known/spiffe/jwks" + "uri": "https://agentrust-io.com/.well-known/spiffe/jwks" }, { "type": "TRACE-v0.2", - "uri": "https://trace.agentrust.io/records/agent-manifest-prod-latest", + "uri": "https://trace.agentrust-io.com/records/agent-manifest-prod-latest", "digest": "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2" } ] } }, { - "identifier": "urn:ai:agentrust.io:governed:trace-registry", + "identifier": "urn:ai:agentrust-io.com:governed:trace-registry", "displayName": "TRACE Registry", "description": "Public append-only Merkle registry for TRACE Trust Record anchors. Query attested session records for any TRACE-governed agent. Supports SCITT-anchored verification.", "type": "application/mcp-server+json", - "url": "https://trace.agentrust.io/mcp", + "url": "https://trace.agentrust-io.com/mcp", "version": "0.2.0", "tags": ["governance", "attestation", "trace", "audit", "scitt"], "capabilities": ["TRACEVerification", "AuditQuery", "SCITTAnchoring"], "trustManifest": { - "identity": "spiffe://trust.agentrust.io/service/trace-registry/prod", + "identity": "spiffe://trust.agentrust-io.com/service/trace-registry/prod", "identityType": "spiffe", "attestations": [ { "type": "SPIFFE-X509", - "uri": "https://agentrust.io/.well-known/spiffe/jwks" + "uri": "https://agentrust-io.com/.well-known/spiffe/jwks" }, { "type": "TRACE-v0.2", - "uri": "https://trace.agentrust.io/records/trace-registry-prod-latest", + "uri": "https://trace.agentrust-io.com/records/trace-registry-prod-latest", "digest": "sha256:f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9" } ] } }, { - "identifier": "urn:ai:agentrust.io:registry:governed-agents", - "displayName": "agentrust.io Governed Agent Registry", + "identifier": "urn:ai:agentrust-io.com:registry:governed-agents", + "displayName": "agentrust-io.com Governed Agent Registry", "description": "Federated ARD registry for TRACE-attested, policy-governed agents. All indexed entries carry TRACE-v0.2 runtime governance attestations. Filter with trustManifest.attestations.type=[TRACE-v0.2] to find governed agents across the federation.", "type": "application/ai-registry+json", - "url": "https://registry.agentrust.io/api/v1/", + "url": "https://registry.agentrust-io.com/api/v1/", "tags": ["registry", "governance", "federation", "trace"] } ] diff --git a/industrial-embodied-ai/catalog.json b/industrial-embodied-ai/catalog.json index 9d9ac55..c0d5bf5 100644 --- a/industrial-embodied-ai/catalog.json +++ b/industrial-embodied-ai/catalog.json @@ -60,7 +60,7 @@ "requires_baa": false, "sensitivity_level": "confidential", "added_at": "2026-06-11T00:00:00Z", - "approved_by": "community-example@agentrust.io" + "approved_by": "community-example@agentrust-io.com" }, { "tool_name": "robot.request_motion", @@ -145,6 +145,6 @@ "requires_baa": false, "sensitivity_level": "confidential", "added_at": "2026-06-11T00:00:00Z", - "approved_by": "community-example@agentrust.io" + "approved_by": "community-example@agentrust-io.com" } ] diff --git a/industrial-embodied-ai/policy/manifest.json b/industrial-embodied-ai/policy/manifest.json index f1a251d..0781cab 100644 --- a/industrial-embodied-ai/policy/manifest.json +++ b/industrial-embodied-ai/policy/manifest.json @@ -1,7 +1,7 @@ { "version": "0.1.0", "authored_at": "2026-06-11T00:00:00Z", - "author_identity": "community-example@agentrust.io", + "author_identity": "community-example@agentrust-io.com", "commit_sha": "development-example", "approval_chain": [] } From cec147dc97a0afa3771f485641862ae9a7cfa913 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 27 Jul 2026 21:36:31 -0700 Subject: [PATCH 2/2] fix: hold back policy manifest and catalog, whose digests are in the record industrial-embodied-ai/policy/manifest.json and catalog.json are not signed themselves, but their SHA-256 digests are recorded inside the signed trust record as cmcp_policy_bundle_hash and the catalog hash. Editing a byte of either breaks the evidence chain, which validate_artifacts.py caught: assert expected["cmcp_policy_bundle_hash"] == policy_hash Same hazard as the signed records, one level removed: unsigned content whose digest lives inside something signed. Reverted both and recorded the reason in the note, since it is the kind of coupling that is invisible until CI fails. Co-Authored-By: Claude Opus 5 (1M context) --- TRACE-VERSION-NOTE.md | 11 +++++++++-- industrial-embodied-ai/catalog.json | 4 ++-- industrial-embodied-ai/policy/manifest.json | 2 +- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/TRACE-VERSION-NOTE.md b/TRACE-VERSION-NOTE.md index c3327cb..585cb53 100644 --- a/TRACE-VERSION-NOTE.md +++ b/TRACE-VERSION-NOTE.md @@ -33,5 +33,12 @@ carry the v0.2 profile with a signature that covers it. Until then, read them as what they are: evidence of runs that happened under v0.1, still verifiable with `agentrust-trace-tests` 0.3.x. -Documentation, catalogs, and policy manifests in this repository **have** moved to -v0.2 and to `agentrust-io.com`, since nothing signs those. +Documentation in this repository **has** moved to v0.2 and to `agentrust-io.com`, +since nothing signs it. + +`industrial-embodied-ai/policy/manifest.json` and `industrial-embodied-ai/catalog.json` +were also held back, for a subtler reason: nothing signs them directly, but their +SHA-256 digests are recorded inside the signed trust record as +`cmcp_policy_bundle_hash` and the catalog hash. Editing a byte of either breaks the +evidence chain even though neither file carries a signature of its own, which +`validate_artifacts.py` catches. They regenerate with the records. diff --git a/industrial-embodied-ai/catalog.json b/industrial-embodied-ai/catalog.json index c0d5bf5..9d9ac55 100644 --- a/industrial-embodied-ai/catalog.json +++ b/industrial-embodied-ai/catalog.json @@ -60,7 +60,7 @@ "requires_baa": false, "sensitivity_level": "confidential", "added_at": "2026-06-11T00:00:00Z", - "approved_by": "community-example@agentrust-io.com" + "approved_by": "community-example@agentrust.io" }, { "tool_name": "robot.request_motion", @@ -145,6 +145,6 @@ "requires_baa": false, "sensitivity_level": "confidential", "added_at": "2026-06-11T00:00:00Z", - "approved_by": "community-example@agentrust-io.com" + "approved_by": "community-example@agentrust.io" } ] diff --git a/industrial-embodied-ai/policy/manifest.json b/industrial-embodied-ai/policy/manifest.json index 0781cab..f1a251d 100644 --- a/industrial-embodied-ai/policy/manifest.json +++ b/industrial-embodied-ai/policy/manifest.json @@ -1,7 +1,7 @@ { "version": "0.1.0", "authored_at": "2026-06-11T00:00:00Z", - "author_identity": "community-example@agentrust-io.com", + "author_identity": "community-example@agentrust.io", "commit_sha": "development-example", "approval_chain": [] }