diff --git a/.github/workflows/aeoess-aps-conformance.yml b/.github/workflows/aeoess-aps-conformance.yml index 8b21697f..73c74d41 100644 --- a/.github/workflows/aeoess-aps-conformance.yml +++ b/.github/workflows/aeoess-aps-conformance.yml @@ -39,7 +39,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install released agentrust-io packages @@ -70,7 +70,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install the package set that reproduces the tested_against result diff --git a/.github/workflows/agentrust-codex-tests.yml b/.github/workflows/agentrust-codex-tests.yml index 73617bb8..2d0e9116 100644 --- a/.github/workflows/agentrust-codex-tests.yml +++ b/.github/workflows/agentrust-codex-tests.yml @@ -29,7 +29,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "${{ matrix.python-version }}" - name: Run capture tests without the signing packages @@ -53,7 +53,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "${{ matrix.python-version }}" - name: Run signing and conformance tests @@ -73,7 +73,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Validate integration and plugin structure diff --git a/.github/workflows/alakris-authority-comparison.yml b/.github/workflows/alakris-authority-comparison.yml index d7c1e902..a6530752 100644 --- a/.github/workflows/alakris-authority-comparison.yml +++ b/.github/workflows/alakris-authority-comparison.yml @@ -21,7 +21,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: "3.12" - name: Install released packages diff --git a/.github/workflows/capture-core-publish.yml b/.github/workflows/capture-core-publish.yml index 4e869207..9266cf8a 100644 --- a/.github/workflows/capture-core-publish.yml +++ b/.github/workflows/capture-core-publish.yml @@ -28,7 +28,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Require release tag and matching package version for publication @@ -65,7 +65,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - run: pip install --require-hashes -r requirements/release.txt @@ -119,7 +119,7 @@ jobs: with: name: dist path: dist/ - - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 github-release: name: Create GitHub Release diff --git a/.github/workflows/capture-core-tests.yml b/.github/workflows/capture-core-tests.yml index 37cc570d..8b5598a8 100644 --- a/.github/workflows/capture-core-tests.yml +++ b/.github/workflows/capture-core-tests.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run core tests @@ -45,7 +45,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install the core from source, then import every engine @@ -75,7 +75,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Engine must name the missing package diff --git a/.github/workflows/chap-conformance.yml b/.github/workflows/chap-conformance.yml index ea05bfad..5aa728e8 100644 --- a/.github/workflows/chap-conformance.yml +++ b/.github/workflows/chap-conformance.yml @@ -40,7 +40,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install released packages @@ -70,7 +70,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install the package set that reproduces the tested_against result diff --git a/.github/workflows/claude-code-tests.yml b/.github/workflows/claude-code-tests.yml index cefc3d0e..cf4a04be 100644 --- a/.github/workflows/claude-code-tests.yml +++ b/.github/workflows/claude-code-tests.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Run the drift suite without the signing packages @@ -48,7 +48,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run full suite (with crypto packages) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b216c941..c03ffb44 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,15 +28,15 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: python queries: +security-extended - name: Autobuild - uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: /language:python diff --git a/.github/workflows/companyscope-incident-register-conformance.yml b/.github/workflows/companyscope-incident-register-conformance.yml index b61a2ec1..d046c2ca 100644 --- a/.github/workflows/companyscope-incident-register-conformance.yml +++ b/.github/workflows/companyscope-incident-register-conformance.yml @@ -28,7 +28,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install integration test dependencies @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install hash-locked integration test dependencies diff --git a/.github/workflows/comply54-conformance.yml b/.github/workflows/comply54-conformance.yml index 335a63ac..f61f9e1d 100644 --- a/.github/workflows/comply54-conformance.yml +++ b/.github/workflows/comply54-conformance.yml @@ -28,7 +28,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install released agentrust-io packages diff --git a/.github/workflows/copilot-integrity.yml b/.github/workflows/copilot-integrity.yml index e21275ec..c93349ad 100644 --- a/.github/workflows/copilot-integrity.yml +++ b/.github/workflows/copilot-integrity.yml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Verify the approved Copilot composition diff --git a/.github/workflows/copilot-tests.yml b/.github/workflows/copilot-tests.yml index 6ea3bf4b..049b15cc 100644 --- a/.github/workflows/copilot-tests.yml +++ b/.github/workflows/copilot-tests.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run the suite against the core in this checkout @@ -47,7 +47,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install the core from this checkout diff --git a/.github/workflows/cursor-integrity.yml b/.github/workflows/cursor-integrity.yml index 8ee277b1..57c95d99 100644 --- a/.github/workflows/cursor-integrity.yml +++ b/.github/workflows/cursor-integrity.yml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Verify the approved Cursor composition diff --git a/.github/workflows/cursor-tests.yml b/.github/workflows/cursor-tests.yml index ee57512e..3a274b6a 100644 --- a/.github/workflows/cursor-tests.yml +++ b/.github/workflows/cursor-tests.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run the suite against the core in this checkout @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install the core from this checkout diff --git a/.github/workflows/demos-ci.yml b/.github/workflows/demos-ci.yml index 4e1ca799..136c8042 100644 --- a/.github/workflows/demos-ci.yml +++ b/.github/workflows/demos-ci.yml @@ -28,7 +28,7 @@ jobs: persist-credentials: false - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" diff --git a/.github/workflows/docker-sandbox-kit-conformance.yml b/.github/workflows/docker-sandbox-kit-conformance.yml index 98e25499..4161d7ab 100644 --- a/.github/workflows/docker-sandbox-kit-conformance.yml +++ b/.github/workflows/docker-sandbox-kit-conformance.yml @@ -25,7 +25,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install released TRACE packages diff --git a/.github/workflows/epilabs-epi-recorder-conformance.yml b/.github/workflows/epilabs-epi-recorder-conformance.yml index 2eede666..a07d40bf 100644 --- a/.github/workflows/epilabs-epi-recorder-conformance.yml +++ b/.github/workflows/epilabs-epi-recorder-conformance.yml @@ -21,7 +21,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install released packages diff --git a/.github/workflows/evidencebound-core-conformance.yml b/.github/workflows/evidencebound-core-conformance.yml index c0b8aff4..ee9f0a5c 100644 --- a/.github/workflows/evidencebound-core-conformance.yml +++ b/.github/workflows/evidencebound-core-conformance.yml @@ -29,7 +29,7 @@ jobs: with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.python }} diff --git a/.github/workflows/examples-ci.yml b/.github/workflows/examples-ci.yml index 02c45c8e..8cd5ab93 100644 --- a/.github/workflows/examples-ci.yml +++ b/.github/workflows/examples-ci.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -58,7 +58,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -99,7 +99,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" cache: "pip" @@ -132,7 +132,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -148,7 +148,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" cache: "pip" @@ -171,7 +171,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -187,7 +187,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -209,7 +209,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -233,7 +233,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" diff --git a/.github/workflows/examples-smoke.yml b/.github/workflows/examples-smoke.yml index 2fe74a3a..83b25bf9 100644 --- a/.github/workflows/examples-smoke.yml +++ b/.github/workflows/examples-smoke.yml @@ -55,7 +55,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" diff --git a/.github/workflows/gemini-cli-integrity.yml b/.github/workflows/gemini-cli-integrity.yml index 883fee2d..bb233a86 100644 --- a/.github/workflows/gemini-cli-integrity.yml +++ b/.github/workflows/gemini-cli-integrity.yml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Verify the approved Gemini CLI composition diff --git a/.github/workflows/gemini-cli-tests.yml b/.github/workflows/gemini-cli-tests.yml index 8ea34115..7ec6e59b 100644 --- a/.github/workflows/gemini-cli-tests.yml +++ b/.github/workflows/gemini-cli-tests.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run the suite against the core in this checkout @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install the core from this checkout diff --git a/.github/workflows/horizonshield-ca2a-companion-conformance.yml b/.github/workflows/horizonshield-ca2a-companion-conformance.yml index e9202ca9..2c7330fb 100644 --- a/.github/workflows/horizonshield-ca2a-companion-conformance.yml +++ b/.github/workflows/horizonshield-ca2a-companion-conformance.yml @@ -38,7 +38,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install this integration with its pins diff --git a/.github/workflows/horizonshield-musubi-trace-terms-conformance.yml b/.github/workflows/horizonshield-musubi-trace-terms-conformance.yml new file mode 100644 index 00000000..8ec665cd --- /dev/null +++ b/.github/workflows/horizonshield-musubi-trace-terms-conformance.yml @@ -0,0 +1,59 @@ +# MUSUBI trace terms (musubi-trace-terms-v0) workflow. +# +# fixed installs the entry with its exact pins: agentrust-trace and +# agentrust-trace-tests as named in integration.yaml tested_against, +# and nenrin-verify 0.5.6. +# floating installs the latest agentrust-trace and agentrust-trace-tests +# releases instead, unpinned on purpose, as drift detection. The +# evaluator calls TRACE's own verify_bridge, so a release that +# changes a verdict shows up here. +# Both evaluate the 55 vendored vectors, check the vendored bytes, run the +# evaluator's CLI, and run trace-tests Level 0 on the two Trust Records the +# vectors consume. Nothing is fetched at test time. +name: horizonshield-musubi-trace-terms conformance +on: + push: + paths: + - "integrations/horizonshield-musubi-trace-terms/**" + - ".github/workflows/horizonshield-musubi-trace-terms-conformance.yml" + pull_request: + paths: + - "integrations/horizonshield-musubi-trace-terms/**" + - ".github/workflows/horizonshield-musubi-trace-terms-conformance.yml" + schedule: + - cron: "0 6 * * 1" # weekly: catch drift against the latest released packages + workflow_dispatch: + +permissions: + contents: read + +jobs: + check: + name: ${{ matrix.mode }} (py${{ matrix.python }}) + strategy: + fail-fast: false + matrix: + python: ["3.11", "3.12", "3.13"] + mode: [fixed, floating] + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: ${{ matrix.python }} + - name: Install this integration with its pins (tested_against) + if: matrix.mode == 'fixed' + run: | + v=$(sed -n 's/^ agentrust-trace: "\(.*\)"$/\1/p' integrations/horizonshield-musubi-trace-terms/integration.yaml) + t=$(sed -n 's/^ agentrust-trace-tests: "\(.*\)"$/\1/p' integrations/horizonshield-musubi-trace-terms/integration.yaml) + test -n "$v" && test -n "$t" + pip install -e "integrations/horizonshield-musubi-trace-terms[test]" "agentrust-trace==$v" "agentrust-trace-tests==$t" + - name: Install the latest agentrust-trace releases + if: matrix.mode == 'floating' + run: pip install agentrust-trace agentrust-trace-tests "nenrin-verify==0.5.6" "pytest>=8" + - name: Record the versions under test + run: pip show agentrust-trace agentrust-trace-tests nenrin-verify | grep -E '^(Name|Version):' + - name: Integration tests + run: python -m pytest integrations/horizonshield-musubi-trace-terms/tests -q diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 05c9b70a..6ddcd007 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -35,7 +35,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install ruff diff --git a/.github/workflows/maintenance-report.yml b/.github/workflows/maintenance-report.yml index a616d513..fb938a88 100644 --- a/.github/workflows/maintenance-report.yml +++ b/.github/workflows/maintenance-report.yml @@ -15,7 +15,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - run: pip install --require-hashes -r requirements/maintenance.txt diff --git a/.github/workflows/pic-standard-mcp-guard-conformance.yml b/.github/workflows/pic-standard-mcp-guard-conformance.yml index 0419373c..a1894adc 100644 --- a/.github/workflows/pic-standard-mcp-guard-conformance.yml +++ b/.github/workflows/pic-standard-mcp-guard-conformance.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install this integration (declared lower bounds) @@ -73,7 +73,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install the package set that reproduces the tested_against result diff --git a/.github/workflows/probityai-observed-effect-conformance.yml b/.github/workflows/probityai-observed-effect-conformance.yml index c4c451f6..7a5b9659 100644 --- a/.github/workflows/probityai-observed-effect-conformance.yml +++ b/.github/workflows/probityai-observed-effect-conformance.yml @@ -34,7 +34,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install agentrust-trace (latest release) @@ -52,7 +52,7 @@ jobs: run: pytest integrations/probityai-observed-effect/tests -q # The corpus runner requires Python 3.13 or later, so it runs in its own # interpreter and the replay happens on every matrix leg. - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 id: replay-python with: python-version: "3.13" diff --git a/.github/workflows/ramen-ai-cmcp-conformance.yml b/.github/workflows/ramen-ai-cmcp-conformance.yml index c0621408..05aa10b2 100644 --- a/.github/workflows/ramen-ai-cmcp-conformance.yml +++ b/.github/workflows/ramen-ai-cmcp-conformance.yml @@ -28,7 +28,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install integration and exact TRACE test release diff --git a/.github/workflows/scheduled-agents-tests.yml b/.github/workflows/scheduled-agents-tests.yml index 3ccd38e1..84d46a97 100644 --- a/.github/workflows/scheduled-agents-tests.yml +++ b/.github/workflows/scheduled-agents-tests.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Run the drift suite without the signing packages @@ -47,7 +47,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run full suite (with crypto packages) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cd068447..33ce9794 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -35,6 +35,6 @@ jobs: publish_results: false - name: Upload SARIF - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: scorecard-results.sarif diff --git a/.github/workflows/sentinel-conformance.yml b/.github/workflows/sentinel-conformance.yml index 45bb158c..028a6ce0 100644 --- a/.github/workflows/sentinel-conformance.yml +++ b/.github/workflows/sentinel-conformance.yml @@ -28,7 +28,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install integration test dependencies @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install hash-locked integration test dependencies diff --git a/.github/workflows/shadow-ai-tests.yml b/.github/workflows/shadow-ai-tests.yml index ff594032..3fe892a1 100644 --- a/.github/workflows/shadow-ai-tests.yml +++ b/.github/workflows/shadow-ai-tests.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Install tests diff --git a/.github/workflows/spendguard-conformance.yml b/.github/workflows/spendguard-conformance.yml index 120bc886..6fad7854 100644 --- a/.github/workflows/spendguard-conformance.yml +++ b/.github/workflows/spendguard-conformance.yml @@ -28,7 +28,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install released agentrust-io packages diff --git a/.github/workflows/sync-agt-marketplace.yml b/.github/workflows/sync-agt-marketplace.yml index ad96ce4c..bb1062c9 100644 --- a/.github/workflows/sync-agt-marketplace.yml +++ b/.github/workflows/sync-agt-marketplace.yml @@ -20,7 +20,7 @@ jobs: fetch-depth: 1 path: .agt-source persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install the test runner diff --git a/.github/workflows/trace-adapters-publish.yml b/.github/workflows/trace-adapters-publish.yml index fab77cac..b4dea4fe 100644 --- a/.github/workflows/trace-adapters-publish.yml +++ b/.github/workflows/trace-adapters-publish.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Require release tag and matching package version for publication @@ -59,7 +59,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - run: pip install --require-hashes -r requirements/release.txt @@ -96,7 +96,7 @@ jobs: with: name: trace-adapters-dist path: dist/ - - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 github-release: name: Create GitHub Release diff --git a/.github/workflows/trace-adapters-tests.yml b/.github/workflows/trace-adapters-tests.yml index 0d53e742..53a878d0 100644 --- a/.github/workflows/trace-adapters-tests.yml +++ b/.github/workflows/trace-adapters-tests.yml @@ -46,7 +46,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Test against the released TRACE model @@ -65,7 +65,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Build a record with the DecisionAssure adapter and validate it @@ -111,7 +111,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Test the OTel GenAI adapter @@ -136,7 +136,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Test OpenShell evidence mapping against released TRACE @@ -154,7 +154,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Test evidence rules without framework extras @@ -177,7 +177,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Test released FunctionAgent workflow observation @@ -195,7 +195,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Test the record rules without the SDK @@ -213,7 +213,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Test evidence rules without Google ADK diff --git a/.github/workflows/trace-adapters-verify-provenance.yml b/.github/workflows/trace-adapters-verify-provenance.yml index b0a87a4c..8cd2efda 100644 --- a/.github/workflows/trace-adapters-verify-provenance.yml +++ b/.github/workflows/trace-adapters-verify-provenance.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install independent provenance verifier diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 684b6c44..87dccb46 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -15,7 +15,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Validate integration manifests against schema diff --git a/.github/workflows/wcm-integrations-tests.yml b/.github/workflows/wcm-integrations-tests.yml index a18089ab..d2e22f0c 100644 --- a/.github/workflows/wcm-integrations-tests.yml +++ b/.github/workflows/wcm-integrations-tests.yml @@ -40,7 +40,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Install the published SDK and test-only extras @@ -66,7 +66,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - run: pip install --require-hashes -r requirements/wcm-harness.txt diff --git a/.github/workflows/windsurf-integrity.yml b/.github/workflows/windsurf-integrity.yml index 81c62db2..4f22abfe 100644 --- a/.github/workflows/windsurf-integrity.yml +++ b/.github/workflows/windsurf-integrity.yml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Verify the approved Windsurf composition diff --git a/.github/workflows/windsurf-tests.yml b/.github/workflows/windsurf-tests.yml index 27b85168..5f5f66ac 100644 --- a/.github/workflows/windsurf-tests.yml +++ b/.github/workflows/windsurf-tests.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Run the suite against the core in this checkout @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install the core from this checkout diff --git a/.github/workflows/xchk-registry-conformance.yml b/.github/workflows/xchk-registry-conformance.yml index c43edec6..6c2a127e 100644 --- a/.github/workflows/xchk-registry-conformance.yml +++ b/.github/workflows/xchk-registry-conformance.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - name: Install agentrust-trace and agentrust-trace-tests (latest release) diff --git a/README.md b/README.md index 1f8f168a..1f1749da 100644 --- a/README.md +++ b/README.md @@ -66,16 +66,16 @@ TRACE only works as a standard if it is genuinely neutral. Integrations are list | [EvidenceBound Core](integrations/evidencebound-core/) | EvidenceBound | trace | community | | [Google ADK](integrations/google-adk/) | agentrust-io | trace | verified | | [MUSUBI companion for cA2A](integrations/horizonshield-ca2a-companion/) | The HORIZONs Co., Ltd. | ca2a | community | +| [MUSUBI trace terms](integrations/horizonshield-musubi-trace-terms/) | The HORIZONs Co., Ltd. | trace | community | | [LangChain](integrations/langchain/) | agentrust-io | trace | verified | | [SOVP](integrations/litzki-systems-sovp/) | Litzki Systems | trace | verified | | [LlamaIndex](integrations/llamaindex/) | agentrust-io | trace | verified | -| [Nobulex](integrations/nobulex/) | Nobulex | trace | verified | | [OntoGuard Decision Authorization](integrations/ontoguard-decision-authorization/) | OntoGuard AI | trace | verified | | [OpenAI Agents SDK](integrations/openai-agents/) | agentrust-io | trace | verified | | [OpenShell TRACE Adapter](integrations/openshell/) | agentrust-io | trace | community | | [OpenTelemetry GenAI](integrations/otel-genai/) | agentrust-io | trace | community | | [Parmana](integrations/parmana-server/) | Parmana Systems | trace | verified | -| [PIC Standard MCP Guard](integrations/pic-standard-mcp-guard/) | PIC Standard | trace | community | +| [PIC Standard MCP Guard](integrations/pic-standard-mcp-guard/) | PIC Standard | trace | verified | | [Observed-effect references](integrations/probityai-observed-effect/) | probityai | trace | community | | [ramen-ai cMCP Adapter](integrations/ramen-ai-cmcp/) | ramen-ai | cmcp, trace | verified | | [SAGE AgenTrust Bridge](integrations/sage-agenttrust/) | SAGE | cmcp, trace | community | diff --git a/demos/requirements/ci.txt b/demos/requirements/ci.txt index 9e9e80ab..6e76c44b 100644 --- a/demos/requirements/ci.txt +++ b/demos/requirements/ci.txt @@ -126,9 +126,9 @@ cedarpy==4.12.1 \ --hash=sha256:e8ed70991b958f344017663f753f044070cd0e61dfd4ffe408ba05d48c48dea4 \ --hash=sha256:f164ca11999e1d3a1641548d17755c3c45a5385b2590a642ef3122a1196947ca # via cmcp-runtime -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx diff --git a/examples/agentic-commerce-accountability/released_ucp/README.md b/examples/agentic-commerce-accountability/released_ucp/README.md index 72b62db6..6e83f47c 100644 --- a/examples/agentic-commerce-accountability/released_ucp/README.md +++ b/examples/agentic-commerce-accountability/released_ucp/README.md @@ -37,7 +37,7 @@ mypy, Bandit, and the final line `OFFLINE_SMOKE_PASSED`. A failing stage stops t smoke. CI runs this same script as non-root UID/GID `10001:10001`, without network access, writable image layers, Linux capabilities, secrets, or publishing steps. -For host development with Python 3.12 and uv 0.12.5: +For host development with Python 3.12 and uv 0.13.4: ```sh uv sync --frozen diff --git a/examples/agentic-commerce-accountability/released_ucp/uv-bootstrap.txt b/examples/agentic-commerce-accountability/released_ucp/uv-bootstrap.txt index 91255f0f..b42f57c5 100644 --- a/examples/agentic-commerce-accountability/released_ucp/uv-bootstrap.txt +++ b/examples/agentic-commerce-accountability/released_ucp/uv-bootstrap.txt @@ -1,6 +1,6 @@ -# Official PyPI uv 0.12.5 wheels for Linux amd64 and arm64 only. -# https://pypi.org/pypi/uv/0.12.5/json -uv==0.12.5 \ - --hash=sha256:2d65b7b3bc3fd28678f62aa7fb5d90f106ad9782c1354af60b6cecdf9ea9ecd9 \ - --hash=sha256:3e195ccf1ed60c8bb24a6447ce306441a4181d54b602407e09bc56e963911c15 \ - --hash=sha256:58abfb0f658b39a834307a11223bc170294ea214263b4c99ecc7663720d43544 +# Official PyPI uv 0.13.4 wheels for Linux amd64 and arm64 only. +# https://pypi.org/pypi/uv/0.13.4/json +uv==0.13.4 \ + --hash=sha256:05e4332791b4d55b6dde8695b7fa6079b26991519f44760887c5dfbd5ca4fe53 \ + --hash=sha256:7b3cdf868e5415631fe797b648c0d6945d38d388f23367bdd0b6332e80a1fcb0 \ + --hash=sha256:e90ab42825587821096cb0d071e387468da38cfa22818c91f9c0b3c0453048e8 diff --git a/examples/agentic-commerce-accountability/released_ucp/uv.lock b/examples/agentic-commerce-accountability/released_ucp/uv.lock index 958c8c69..8473fc09 100644 --- a/examples/agentic-commerce-accountability/released_ucp/uv.lock +++ b/examples/agentic-commerce-accountability/released_ucp/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = "==3.12.*" [[package]] @@ -138,11 +138,11 @@ filecache = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/examples/industrial-embodied-ai/requirements-presenter.txt b/examples/industrial-embodied-ai/requirements-presenter.txt index c8a592f8..a7ebd7ad 100644 --- a/examples/industrial-embodied-ai/requirements-presenter.txt +++ b/examples/industrial-embodied-ai/requirements-presenter.txt @@ -128,9 +128,9 @@ cedarpy==4.12.1 \ # via # -r requirements.txt # cmcp-runtime -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx diff --git a/examples/requirements/smoke-harness.txt b/examples/requirements/smoke-harness.txt index f701bd84..d4635016 100644 --- a/examples/requirements/smoke-harness.txt +++ b/examples/requirements/smoke-harness.txt @@ -4,9 +4,9 @@ anyio==4.15.1 \ --hash=sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101 \ --hash=sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94 # via httpx -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx diff --git a/examples/weight-custody-manifest/README.md b/examples/weight-custody-manifest/README.md index 05e87a4a..929043dc 100644 --- a/examples/weight-custody-manifest/README.md +++ b/examples/weight-custody-manifest/README.md @@ -15,7 +15,7 @@ For a public open-weight model, base-weight confidentiality is theater (anyone c ```bash git clone https://github.com/agentrust-io/integrations.git cd integrations/examples/weight-custody-manifest -pip install -r requirements.txt # weight-custody-manifest>=0.21.0, Python 3.11+ +pip install -r requirements.txt # weight-custody-manifest>=0.33.1, Python 3.11+ ``` The offline demos need nothing else. `real_open_model.py` needs run-local extras (below). diff --git a/examples/weight-custody-manifest/real_lora_custody.py b/examples/weight-custody-manifest/real_lora_custody.py index d4d26058..58b217e0 100644 --- a/examples/weight-custody-manifest/real_lora_custody.py +++ b/examples/weight-custody-manifest/real_lora_custody.py @@ -28,7 +28,6 @@ from cryptography.hazmat.primitives.ciphers.aead import AESGCM from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ec -from model_signing import signing as model_signing from wcm import ( Ed25519Signer, @@ -39,6 +38,7 @@ artifact_files, generate_ed25519, generate_transport_keypair, + manifest_identity, model_signing_digest, open_sealed, verify_manifest, @@ -54,6 +54,12 @@ def sign_artifact(root: pathlib.Path, output: pathlib.Path) -> tuple[str, pathlib.Path, pathlib.Path]: """Create a detached OpenSSF signature, retaining no private signing key.""" + # Imported here, not at module level: this is the only function that + # needs the model-signing extra, and the KBS release path below (see + # build_kbs) must stay importable - by main() and by + # test_kbs_manifest_pinning.py - without requiring it or torch. + from model_signing import signing as model_signing + signature_path = output / "adapter.model-signing.sig" public_key_path = output / "adapter.model-signing.pub.pem" key = ec.generate_private_key(ec.SECP256R1()) @@ -204,6 +210,29 @@ def run_inference(base_path: pathlib.Path, adapter_path: pathlib.Path) -> str: return tokenizer.decode(output[0], skip_special_tokens=True) +def build_kbs(manifest: WeightCustodyManifest, key: bytes) -> KeyBrokerService: + """The manifest-pinned KBS that releases the derivative key. + + A KBS built without ``trusted_manifest_identities`` never releases, no + matter how valid the attestation evidence is, so dropping the pin here + is a silent regression unless something exercises this exact + construction. It's factored out of ``main`` for exactly that reason: so + ``test_kbs_manifest_pinning.py`` can call it directly, without training a + LoRA adapter, downloading a model, or needing torch or the model-signing + extra - this module has no other dependency that isn't already needed + offline. + """ + return KeyBrokerService( + {manifest.weights_hash: key}, + require_channel_binding=True, + # Without this the manifest is not pinned, so verify_and_release + # refuses on manifest_authorized regardless of attestation and the + # KBS never returns a sealed key: see real_open_model.py and the + # other offline demos, which all pin it the same way. + trusted_manifest_identities=[manifest_identity(manifest)], + ) + + def main() -> int: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--model", default="HuggingFaceTB/SmolLM2-135M-Instruct") @@ -272,9 +301,7 @@ def main() -> int: raise RuntimeError("joint derivative-manifest verification failed") transport_private, transport_public = generate_transport_keypair() - kbs = KeyBrokerService( - {manifest.weights_hash: key}, require_channel_binding=True - ) + kbs = build_kbs(manifest, key) challenge = kbs.issue_challenge() evidence = SoftwareProvider().produce( challenge, diff --git a/examples/weight-custody-manifest/requirements.txt b/examples/weight-custody-manifest/requirements.txt index ee29129e..9627bf9b 100644 --- a/examples/weight-custody-manifest/requirements.txt +++ b/examples/weight-custody-manifest/requirements.txt @@ -1,4 +1,4 @@ # The Weight Custody Manifest reference SDK, from PyPI. # Covers the offline examples. provenance_model_signing.py additionally needs the # [model-signing] extra: pip install "weight-custody-manifest[model-signing]". -weight-custody-manifest>=0.32.0 +weight-custody-manifest>=0.33.1 diff --git a/examples/weight-custody-manifest/revocation_kill_switch.py b/examples/weight-custody-manifest/revocation_kill_switch.py index 71be7b35..4c41076b 100644 --- a/examples/weight-custody-manifest/revocation_kill_switch.py +++ b/examples/weight-custody-manifest/revocation_kill_switch.py @@ -120,13 +120,40 @@ def main() -> int: rule("Step 2 - A recall revokes the attestation key. New releases are refused.") # The revocation authority marks the key revoked; the KBS enforces it live. + # Pinned the same way as Step 1's broker, so this step isolates revocation: + # without it, the release is also refused on manifest_authorized, and the + # demo would be showing an unpinned broker, not the kill switch. revoked_kbs = KeyBrokerService( - {weights_hash: key}, now=lambda: NOW, revoked_attestation_keys={LIVE_KEY_ID} + {weights_hash: key}, + now=lambda: NOW, + revoked_attestation_keys={LIVE_KEY_ID}, + trusted_manifest_identities=[manifest_identity(manifest)], ) denied = _release(revoked_kbs, manifest, serving) print("new release after recall:", denied.released, " (refused)") reason = next((c.detail for c in denied.failures if c.name == "attestation_revocation"), None) print("why :", reason) + if denied.released or reason is None: + raise RuntimeError("expected the release to be refused on attestation_revocation") + # Checks are independent, not short-circuited: if revoked_kbs's manifest + # pin were ever dropped, attestation_revocation would still fail and the + # check above would still pass, even though the pin itself is broken. So + # isolating revocation requires positively locating manifest_authorized + # and confirming it passed - not just confirming its name is absent from + # the failures, which would also be true if the check never ran at all + # (renamed, removed, or otherwise gone from a future SDK release). + manifest_checks = [c for c in denied.checks if c.name == "manifest_authorized"] + if len(manifest_checks) != 1: + raise RuntimeError( + f"expected exactly one manifest_authorized check to run, found " + f"{len(manifest_checks)}: {[c.name for c in denied.checks]}" + ) + if not manifest_checks[0].passed: + raise RuntimeError( + "expected manifest_authorized to pass so this step isolates " + "revocation; it failed too, meaning revoked_kbs's manifest pin " + "is broken and this is no longer demonstrating the kill switch" + ) rule("Step 3 - The enclave already serving zeroizes at the next cadence lapse") later = NOW + timedelta(minutes=31) # past the 30m window, and re-attestation now fails diff --git a/examples/weight-custody-manifest/test_kbs_manifest_pinning.py b/examples/weight-custody-manifest/test_kbs_manifest_pinning.py new file mode 100644 index 00000000..b771ea3c --- /dev/null +++ b/examples/weight-custody-manifest/test_kbs_manifest_pinning.py @@ -0,0 +1,145 @@ +"""Regression test for KBS manifest pinning: a release must require a pin. + +A ``KeyBrokerService`` that isn't given ``trusted_manifest_identities`` never +releases a key, no matter how valid the attestation evidence is - a caller +could otherwise present an attacker-authored manifest that reuses a weights +hash the broker already holds and be released against terms nobody agreed. +So every KBS a demo or a real release path builds needs that pin, and losing +it silently is the regression this file exists to catch. + +``real_lora_custody.py``'s full launch path needs torch, PEFT and a model +download, so the whole script is excluded from ``run_demos.py`` (see +``REQUIRES_NETWORK``), and its own unit tests in ``test_real_lora_custody.py`` +only cover the encryption/decryption helpers - not the ``KeyBrokerService`` / +``trusted_manifest_identities`` path. That path is factored out as +``real_lora_custody.build_kbs``, which has no heavy dependency of its own, so +this test imports and calls it directly: if the manifest pin is ever dropped +from that function, these tests fail the same run that broke it, instead of +only failing on the one launch command nothing in CI exercises. + +To additionally guard the revocation-isolation invariant (see +``revocation_kill_switch.py``), this file also covers the manifest-pinning +behavior of a plain ``KeyBrokerService`` directly, independent of which demo +constructs it. +""" +from __future__ import annotations + +from wcm import CheckResult, KeyBrokerService, ReleaseDecision, manifest_identity + +import real_lora_custody +from revocation_kill_switch import LIVE_KEY_ID, NOW, _release, build_manifest, sha256 + +WEIGHTS_HASH = sha256(b"the model weights") +SERVING = sha256(b"measured serving stack") +KEY = b"the-weight-decryption-key" + + +def _manifest(): + return build_manifest(WEIGHTS_HASH, SERVING) + + +def _check(decision: ReleaseDecision, name: str) -> CheckResult: + """The single check named ``name``, asserting it actually ran. + + A release decision is a list of named checks; looking one up by name and + requiring exactly one match is what makes an assertion about it + meaningful. Both ``"x" not in failure_names`` and + ``all(c.passed for c in checks if c.name == "x")`` pass vacuously if a + check by that name never ran at all - renamed, removed, or never added - + which is exactly the kind of regression a security test like this one + needs to catch rather than silently pass through. + """ + matches = [c for c in decision.checks if c.name == name] + assert len(matches) == 1, ( + f"expected exactly one {name!r} check to run, found {len(matches)}: " + f"{[c.name for c in decision.checks]}" + ) + return matches[0] + + +# -- real_lora_custody.build_kbs: the production KBS construction ---------- +# +# This test calls the production helper directly, not a KBS rebuilt here. If +# the trusted_manifest_identities pin is ever dropped from build_kbs, this +# test fails: build_kbs would return an unpinned broker, and the release it +# attempts would be refused on manifest_authorized instead of succeeding. + + +def test_lora_kbs_with_pinned_manifest_is_released() -> None: + manifest = _manifest() + kbs = real_lora_custody.build_kbs(manifest, KEY) + decision = _release(kbs, manifest, SERVING) + assert decision.released is True + assert _check(decision, "manifest_authorized").passed is True + + +# -- KeyBrokerService manifest-pinning behavior, independent of any demo ---- + + +def test_pinned_manifest_is_released() -> None: + """A KBS pinned to the manifest's identity releases the key.""" + manifest = _manifest() + kbs = KeyBrokerService( + {WEIGHTS_HASH: KEY}, + now=lambda: NOW, + trusted_manifest_identities=[manifest_identity(manifest)], + ) + decision = _release(kbs, manifest, SERVING) + assert decision.released is True + assert _check(decision, "manifest_authorized").passed is True + + +def test_unpinned_manifest_is_refused_on_manifest_authorized() -> None: + """Without the pin, release is refused on manifest_authorized specifically. + + A KBS built without ``trusted_manifest_identities`` never releases, + regardless of how valid the attestation evidence is. + """ + manifest = _manifest() + kbs = KeyBrokerService({WEIGHTS_HASH: KEY}, now=lambda: NOW) + decision = _release(kbs, manifest, SERVING) + assert decision.released is False + assert _check(decision, "manifest_authorized").passed is False + + +def test_revocation_is_isolated_when_manifest_is_pinned() -> None: + """Pinned + revoked key -> refused on attestation_revocation alone. + + Checks are independent, not short-circuited, so a release can be + correctly refused "for a reason" even when the manifest pin itself is + broken. Isolating revocation requires manifest_authorized to have + positively PASSED - not merely that no failure with that name was seen, + which would also be true if the check never ran at all. + """ + manifest = _manifest() + kbs = KeyBrokerService( + {WEIGHTS_HASH: KEY}, + now=lambda: NOW, + revoked_attestation_keys={LIVE_KEY_ID}, + trusted_manifest_identities=[manifest_identity(manifest)], + ) + decision = _release(kbs, manifest, SERVING) + assert decision.released is False + assert _check(decision, "attestation_revocation").passed is False + assert _check(decision, "manifest_authorized").passed is True + + +def test_revocation_without_pin_also_fails_manifest_authorized() -> None: + """Dropping the pin on a revoked KBS fails both checks, not just one. + + A KBS built without the pin that also has a revoked attestation key + still produces an ``attestation_revocation`` failure (checks run + independently), which is exactly why a test that only checks for that + one failure name cannot tell a correctly isolated revocation apart from + a broken manifest pin. Both checks must fail here. + """ + manifest = _manifest() + kbs = KeyBrokerService( + {WEIGHTS_HASH: KEY}, + now=lambda: NOW, + revoked_attestation_keys={LIVE_KEY_ID}, + ) + decision = _release(kbs, manifest, SERVING) + assert decision.released is False + assert _check(decision, "attestation_revocation").passed is False + assert _check(decision, "manifest_authorized").passed is False diff --git a/integrations/aeoess-aps/aps_action_receipt.py b/integrations/aeoess-aps/aps_action_receipt.py index b74d4639..db5210ed 100644 --- a/integrations/aeoess-aps/aps_action_receipt.py +++ b/integrations/aeoess-aps/aps_action_receipt.py @@ -217,9 +217,18 @@ def verify_aps_action_receipt( append a descriptor to a published receipt without changing its ``receipt_id``. """ - if reference_time.tzinfo is None or reference_time.utcoffset() is None: + if ( + not isinstance(reference_time, datetime) + or reference_time.tzinfo is None + or reference_time.utcoffset() is None + ): raise ValueError("reference_time must be timezone aware") - if max_age_seconds < 0 or clock_skew_seconds < 0: + if ( + type(max_age_seconds) is not int + or type(clock_skew_seconds) is not int + or max_age_seconds < 0 + or clock_skew_seconds < 0 + ): raise ValueError("max_age_seconds and clock_skew_seconds must be non-negative") if not isinstance(receipt, dict): raise TypeError("receipt must be a dict") @@ -318,7 +327,7 @@ def verify_aps_action_receipt( if recomputed != receipt["action_ref"]: checks["action_binding"] = FAIL reasons.append("action_ref_mismatch") - elif action["agent_id"] != receipt["subject_agent"]: + elif not isinstance(action, dict) or action.get("agent_id") != receipt["subject_agent"]: checks["action_binding"] = FAIL reasons.append("action_agent_mismatch") else: diff --git a/integrations/aeoess-aps/tests/test_action_receipt.py b/integrations/aeoess-aps/tests/test_action_receipt.py index f8eb6414..9c446b48 100644 --- a/integrations/aeoess-aps/tests/test_action_receipt.py +++ b/integrations/aeoess-aps/tests/test_action_receipt.py @@ -613,3 +613,24 @@ def test_reference_time_must_be_aware() -> None: def test_status_vocabulary_is_closed() -> None: assert set(STATUSES) == {VERIFIED, INVALID, UNVERIFIED} + + +@pytest.mark.parametrize( + ("bad_age", "bad_skew"), + [ + (True, 0), + (False, 0), + (60, True), + (60.5, 0), + (60, 0.5), + (float("inf"), 0), + ], +) +def test_verify_aps_action_receipt_rejects_boolean_or_float_window_bounds( + bad_age, bad_skew +) -> None: + receipt, pinned, action = _mint() + with pytest.raises(ValueError, match="max_age_seconds"): + _verify(receipt, pinned, action, max_age_seconds=bad_age, clock_skew_seconds=bad_skew) + with pytest.raises(ValueError, match="reference_time"): + _verify(receipt, pinned, action, reference_time="2026-09-18T12:00:00Z") # type: ignore[arg-type] diff --git a/integrations/horizonshield-musubi-trace-terms/.gitattributes b/integrations/horizonshield-musubi-trace-terms/.gitattributes new file mode 100644 index 00000000..5c772ae4 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/.gitattributes @@ -0,0 +1,2 @@ +# Vendored bytes; the tests check them against their SHA-256. +vendor/** -text diff --git a/integrations/horizonshield-musubi-trace-terms/LICENSE b/integrations/horizonshield-musubi-trace-terms/LICENSE new file mode 100644 index 00000000..c22a9ee4 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 The HORIZONs Co., Ltd. (The HORIZ音s株式会社) + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/integrations/horizonshield-musubi-trace-terms/NOTICE b/integrations/horizonshield-musubi-trace-terms/NOTICE new file mode 100644 index 00000000..faceb00e --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/NOTICE @@ -0,0 +1,15 @@ +horizonshield-musubi-trace-terms: MIT, copyright (c) 2026 The HORIZONs Co., Ltd. See LICENSE. + +vendor/trace-terms-v0/vectors/vectors.json carries, unchanged, two Trust Records +copied from agentrust-io/trace-registry at commit +58850e9d0f7113be2a4c89b3c2e7b03447f2dcce (staging/processed/), licensed +CC BY 4.0 by their authors: + + summit-demo-record.json + producer verifiable-agent-summit-demo/0.1.0 + sha256 of the registry file d9fbf07c7813b10da4cacdfda4260ba829178409a26829dbcdb4512eac08a51c + bernstein-3.20.0-20260920-165918-backend-99365805.json + producer bernstein/3.20.0 (the "trace" member of the registry file) + sha256 of the registry file bd39b2ecdea66b20e186663e24cd0217eab3f458256ef607ed2111a965481efb + +License: https://creativecommons.org/licenses/by/4.0/ diff --git a/integrations/horizonshield-musubi-trace-terms/README.md b/integrations/horizonshield-musubi-trace-terms/README.md new file mode 100644 index 00000000..9ee48a4b --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/README.md @@ -0,0 +1,158 @@ +# MUSUBI trace terms + +`musubi-trace-terms-v0` reads TRACE evidence about an agent's tool calls and +judges it against what two parties agreed. Its inputs are one bundle: an +`a2a-contract-v0` both parties signed, a terms annex both parties signed +(agreed authorizer keys, a map from TRACE tool names to contract actions, +per-action and total call counts, and optionally the runtime they agreed on), +the authorizer public keys, and one item per executed call. Each item holds an +act the contractor signed, the PIC/TRACE authorization +(`tag:agentrust-io.com,2026:pic-trace-bridge-v1`) with its tool call, +declaration and transcript, and optionally the Trust Record the act names. The +output is a verdict per call and overall: `within_terms`, `outside_terms`, +`undetermined` or `refused`. + +TRACE checks one call against one authorization; this adds up all the calls +under one two-party contract. + +The evaluator does not reimplement TRACE. Each authorization is checked by +`agentrust_trace.intent_bridge.verify_bridge` from the released +[agentrust-trace 0.11.0](https://pypi.org/project/agentrust-trace/0.11.0/), at +the time the contractor states the call ran. TRACE objects are read unchanged +and digested as TRACE digests them (RFC 8785). + +The specification, the evaluator and the vector generator live in +[horizon-shield at 05b4924](https://github.com/ogasurfproject-jpg/horizon-shield/tree/05b4924254ebf3c7a5c4523bb2f2fd74ff22b61a/workers/hs-ledger/nenrin/trace-terms-v0) +([SPEC.md](https://github.com/ogasurfproject-jpg/horizon-shield/blob/05b4924254ebf3c7a5c4523bb2f2fd74ff22b61a/workers/hs-ledger/nenrin/trace-terms-v0/SPEC.md) +is the normative text). + +## Pinned to agentrust-trace 0.11.0 + +The evaluator calls TRACE's own `verify_bridge`, so the agentrust-trace +release is part of every verdict, and the 55 vectors were built and are checked +against 0.11.0. This entry pins `agentrust-trace==0.11.0`. The evaluator also +records the version it ran against in its output and adds the finding +`agentrust_trace_not_the_pinned_version` under any other release. + +The JSON Schema shipped in agentrust-trace 0.11.0 is older than the schema on +trace-spec main; this is tracked upstream in +[agentrust-io/trace-spec#591](https://github.com/agentrust-io/trace-spec/issues/591). +Every result in this directory is against the 0.11.0 release. None of it is a +statement about trace-spec main. + +## Run it + +Against released packages, from the repository root: + +```bash +python3 -m venv .venv +. .venv/bin/activate +pip install -e "integrations/horizonshield-musubi-trace-terms[test]" +pytest integrations/horizonshield-musubi-trace-terms/tests -q +``` + +Expected: `75 passed`. Python 3.11 or later. No network access is needed after +installation. + +The evaluator's own self-test and CLI, run directly: + +```bash +MUSUBI_DIR="$(python -c 'from nenrin_verify import musubi; print(musubi.MUSUBI_DIR)')" +PYTHONPATH="$MUSUBI_DIR" python integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/trace_terms_v0.py --selftest +# === 55 / 55 (musubi-trace-terms-v0) === +PYTHONPATH="$MUSUBI_DIR" python integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/trace_terms_v0.py check bundle.json +# exit 0 within_terms, 1 outside_terms, 2 refused, 3 undetermined +``` + +## What is in this directory + +| Path | What it is | +|---|---| +| `vendor/trace-terms-v0/trace_terms_v0.py` | the evaluator, unchanged | +| `vendor/trace-terms-v0/vectors/vectors.json` | the 55 vectors, unchanged | +| `tests/test_trace_terms_vectors.py` | all 55 vectors against their expected results, and named cases | +| `tests/test_trace_terms_vendored.py` | the vendored files' SHA-256 against the source commit, the CLI self-test and exit codes, and `trace-tests verify --level 0` on the two consumed Trust Records | +| `NOTICE` | attribution for the two Trust Records the vectors carry | + +The two vendored files are byte for byte the files at horizon-shield commit +`05b4924254ebf3c7a5c4523bb2f2fd74ff22b61a`: + +| File | SHA-256 | +|---|---| +| `trace_terms_v0.py` | `5fbd7dd7a8d7313973673f2b0593c8b06f7f9f5c01381daf95c8faa81853e069` | +| `vectors/vectors.json` | `a636029b66d66768fbf37ea4e7a61ef0035548d6b0cc407b4c0830a43ac0d38a` | + +The evaluator imports `contract_v0` (MUSUBI's contract verifier), +`agreement_verify` (the canonical form and Ed25519 check) and +`nenrin_verify.trace` (the Trust Record intake). They are not copied here: the +released [nenrin-verify 0.5.6](https://pypi.org/project/nenrin-verify/0.5.6/) +ships them byte for byte from the same repository, and the tests load them +with `nenrin_verify.musubi.load`. nenrin-verify is published by the same +vendor. The vector generator is not vendored, because it reads the source +records from horizon-shield; the horizon-shield workflow rebuilds the vectors +byte for byte. + +## Where the evidence in the vectors comes from + +Every authorization is signed by agentrust-trace's own `sign_bridge`. Two +Trust Records are real records copied unchanged from +[agentrust-io/trace-registry](https://github.com/agentrust-io/trace-registry) +(CC BY 4.0, see `NOTICE`): the summit demo record and a Bernstein 3.20.0 +record. Both pass `trace-tests verify --level 0` with agentrust-trace-tests +0.6.2, which this entry's tests run. Other records are signed in the vectors by +agentrust-trace's `sign_record`. Every other key is a test key derived from a +fixed label. + +## What the tests show + +Each line is a case a per-call check cannot see, shown by a vector: + +| Vector | Result | +|---|---| +| TT01 | three calls, each allowed by TRACE, inside the grant and the counts, on the agreed runtime: `within_terms` | +| TT02, TT03 | every call allowed, the third one more than the parties agreed: `calls_exceed_terms` | +| TT04 | the bridge scope includes the tool and TRACE allows it; the contract prohibits the action: `prohibited_action` | +| TT07 | TRACE verifies the bridge under the supplied key; the principal never agreed to that authorizer: `authorizer_not_agreed` | +| TT08 to TT10 | TRACE's `verify_bridge` refuses (deny, expired, mismatch): reported by kind, with `executed_without_valid_authorization` | +| TT12 | one authorization carried two calls: `authorization_reused` | +| TT15, TT16 | the real Bernstein record outside the runtime the parties agreed, and inside terms that agreed on exactly that runtime | +| TT11, TT36, TT43 | whoever assembles the bundle swaps evidence or withholds a key: `undetermined`, never `outside_terms` | +| TT25 | terms signed by one party only: `refused` | +| TT41 | no acts at all: `undetermined`, not `within_terms` | + +The rule behind every code: an act is outside the terms only on what the +contractor signed and on signatures nobody else can forge. + +## What a verdict does not establish + +From SPEC.md section 8: + +- Anything about acts that were not presented. An act the contractor never + signed, or signed and withheld, is not counted. +- That `executed_at` is true. The contractor states it, within the bridge's + window and the record's age. +- That a grant or an authorizer key was not revoked. Revocations are not read. +- That the runtime which ran the call is the one in the Trust Record the + contractor names, or that any Trust Record claim is true. Nothing here + appraises a hardware attestation. +- That the PIC intent and argument digests are what PIC would compute. +- Liability, fault, or that the contract is a legal agreement. + +Clauses this profile does not judge (conditional grants, amount limits, +approval policies, parent contracts, evidence or recovery requirements) make +the bundle `refused`, not judged as if absent (TT47, TT48, TT52, TT53). + +## What this entry does not claim + +- It emits no Trust Record. TRACE Level 0 is claimed only in the sense stated + in `integration.yaml`: the Trust Records it consumes pass Level 0. +- The evaluator, its specification and its vectors have one author, the + maintainer of this entry. They are not an independent implementation. + +## Conformance CI + +`.github/workflows/horizonshield-musubi-trace-terms-conformance.yml` runs the +tests on Python 3.11, 3.12 and 3.13 in two modes: `fixed` installs the versions +in `tested_against` with this entry's pins, `floating` installs the latest +agentrust-trace and agentrust-trace-tests releases. It runs on changes to this +directory and weekly. diff --git a/integrations/horizonshield-musubi-trace-terms/integration.yaml b/integrations/horizonshield-musubi-trace-terms/integration.yaml new file mode 100644 index 00000000..e86f9906 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/integration.yaml @@ -0,0 +1,37 @@ +name: MUSUBI trace terms +vendor: The HORIZONs Co., Ltd. +integrates_with: + - trace +description: >- + Judges PIC/TRACE authorizations and Trust Records, read unchanged, against a contract and + terms two parties signed, per call and overall: within, outside, undetermined or refused. +maintainer: + github: ogasurfproject-jpg +repository: https://github.com/ogasurfproject-jpg/horizon-shield +license: MIT +tier: community +marketplace: + category: Evidence & receipts + mark: MT + keywords: [contract, authorization, pic-trace-bridge, trust-record, terms, counts] +# Role. The evaluator consumes TRACE evidence: it checks each PIC/TRACE +# authorization with agentrust-trace's own intent_bridge.verify_bridge and +# reads each Trust Record the contractor names. It emits no Trust Record. +# Level 0 here means: the two Trust Records the vectors consume unchanged +# (copied from agentrust-io/trace-registry, see NOTICE) pass +# `trace-tests verify --level 0` (tests/test_trace_terms_vendored.py). No +# higher level is claimed. +trace_roles: + - record-consumer +trace_conformance_level: 0 +tested_against: + agentrust-trace: "0.11.0" + agentrust-trace-tests: "0.6.2" + # The schema records agentrust-io package keys only. The fixed job in + # .github/workflows/horizonshield-musubi-trace-terms-conformance.yml also pins + # nenrin-verify 0.5.6, which supplies contract_v0.py, agreement_verify.py and + # nenrin_verify.trace byte for byte from horizon-shield. + # The JSON Schema in agentrust-trace 0.11.0 is older than the one on + # trace-spec main (agentrust-io/trace-spec#591). Every result here is against + # the 0.11.0 release, not trace-spec main. + # Run on Python 3.11, 3.12 and 3.13. diff --git a/integrations/horizonshield-musubi-trace-terms/pyproject.toml b/integrations/horizonshield-musubi-trace-terms/pyproject.toml new file mode 100644 index 00000000..2b1decdf --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/pyproject.toml @@ -0,0 +1,31 @@ +[build-system] +requires = ["setuptools>=68"] +build-backend = "setuptools.build_meta" + +[project] +name = "horizonshield-musubi-trace-terms-integration" +version = "0.1.0" +description = "Runs musubi-trace-terms-v0 against released agentrust-trace" +requires-python = ">=3.11" +license = "MIT" +dependencies = [ + # Exact pin. The evaluator calls TRACE's own verify_bridge, so the + # agentrust-trace release is part of every verdict; the vectors were built + # and are checked against 0.11.0. + "agentrust-trace==0.11.0", + # contract_v0.py, agreement_verify.py and nenrin_verify.trace, shipped byte + # for byte from horizon-shield. + "nenrin-verify==0.5.6", +] + +[project.optional-dependencies] +test = [ + "pytest>=8", + "agentrust-trace-tests==0.6.2", +] + +[tool.setuptools] +py-modules = [] + +[tool.pytest.ini_options] +testpaths = ["tests"] diff --git a/integrations/horizonshield-musubi-trace-terms/tests/hs_trace_terms_support.py b/integrations/horizonshield-musubi-trace-terms/tests/hs_trace_terms_support.py new file mode 100644 index 00000000..33384960 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/tests/hs_trace_terms_support.py @@ -0,0 +1,51 @@ +"""Load the vendored evaluator against the released packages (shared by the tests). + +trace_terms_v0.py imports contract_v0 and agreement_verify by bare name, and +nenrin_verify.trace as a package module. nenrin-verify ships all three byte for +byte from horizon-shield; nenrin_verify.musubi.load puts the directories of the +first two on sys.path. +""" + +from __future__ import annotations + +import importlib.util +import json +import sys +from pathlib import Path + +from nenrin_verify import musubi + +ENTRY = Path(__file__).resolve().parents[1] +VENDOR = ENTRY / "vendor" / "trace-terms-v0" +VECTORS_PATH = VENDOR / "vectors" / "vectors.json" + +musubi.load("contract_v0") + + +def _load_evaluator(): + if "trace_terms_v0" in sys.modules: + return sys.modules["trace_terms_v0"] + spec = importlib.util.spec_from_file_location("trace_terms_v0", VENDOR / "trace_terms_v0.py") + module = importlib.util.module_from_spec(spec) + sys.modules["trace_terms_v0"] = module + spec.loader.exec_module(module) + return module + + +evaluator = _load_evaluator() +_DOC = json.loads(VECTORS_PATH.read_text(encoding="utf-8")) +VECTORS = {v["id"]: v for v in _DOC["vectors"]} +MUSUBI_DIRS = [musubi.MUSUBI_DIR, musubi.AGREEMENT_DIR] + + +def evaluate(vector_id: str) -> dict: + return evaluator.evaluate(VECTORS[vector_id]["bundle"]) + + +def signature(vector_id: str) -> dict: + """What the evaluator's own --selftest compares: verdict, refusals, and per act index, status, codes.""" + return evaluator._signature(evaluate(vector_id)) + + +def acts(vector_id: str) -> list[tuple[str, list[str]]]: + return [(a["status"], a["codes"]) for a in signature(vector_id)["acts"]] diff --git a/integrations/horizonshield-musubi-trace-terms/tests/test_trace_terms_vectors.py b/integrations/horizonshield-musubi-trace-terms/tests/test_trace_terms_vectors.py new file mode 100644 index 00000000..c85ae3e4 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/tests/test_trace_terms_vectors.py @@ -0,0 +1,82 @@ +"""musubi-trace-terms-v0 against released agentrust-trace 0.11.0. + +All 55 vectors in vendor/trace-terms-v0/vectors/vectors.json are evaluated and +compared with their expected result, exactly as `trace_terms_v0.py --selftest` +does. Every PIC/TRACE authorization in them was signed by agentrust-trace's +own sign_bridge and is checked by its own verify_bridge. The named tests below +are the cases a per-call check cannot see. +""" + +from __future__ import annotations + +import pytest + +from hs_trace_terms_support import VECTORS, acts, evaluate, signature + +WITHIN = ("within_terms", []) + + +def test_there_are_55_vectors(): + assert len(VECTORS) == 55 + + +@pytest.mark.parametrize("vector_id", sorted(VECTORS)) +def test_vector_matches_expected(vector_id): + assert signature(vector_id) == VECTORS[vector_id]["expect"] + + +def test_every_call_allowed_and_inside_the_terms_is_within(): + assert signature("TT01")["verdict"] == "within_terms" + assert acts("TT01") == [WITHIN, WITHIN, WITHIN] + + +def test_each_call_allowed_but_the_count_agreed_is_exceeded(): + assert acts("TT02") == [WITHIN, WITHIN, ("outside_terms", ["calls_exceed_terms"])] + assert acts("TT03")[2:] == [("outside_terms", ["calls_exceed_terms"])] * 2 + + +def test_trace_allows_a_call_the_contract_prohibits(): + assert acts("TT04") == [("outside_terms", ["prohibited_action"])] + + +def test_authorizer_the_principal_never_agreed_to(): + assert acts("TT07") == [("outside_terms", ["authorizer_not_agreed", "executed_without_valid_authorization"])] + + +def test_trace_verify_bridge_refusals_are_reported_by_kind(): + assert acts("TT08") == [("outside_terms", ["authorization_denied", "executed_without_valid_authorization"])] + assert acts("TT09") == [("outside_terms", ["authorization_invalid", "executed_without_valid_authorization"])] + assert acts("TT10") == [("outside_terms", ["authorization_mismatch", "executed_without_valid_authorization"])] + + +def test_one_authorization_carried_two_calls(): + assert acts("TT12") == [WITHIN, ("outside_terms", ["authorization_reused"])] + + +def test_real_registry_record_outside_and_inside_the_agreed_runtime(): + (status, codes), = acts("TT15") + assert status == "outside_terms" and "producer_not_agreed" in codes + assert acts("TT16") == [WITHIN] + + +def test_whoever_assembles_the_bundle_can_only_make_an_act_undetermined(): + assert acts("TT11") == [("undetermined", ["evidence_not_as_signed"])] + assert acts("TT36") == [("undetermined", ["authorizer_key_not_supplied"])] + assert acts("TT43") == [WITHIN, ("undetermined", ["evidence_not_as_signed"])] + + +def test_terms_not_signed_by_both_parties_are_refused(): + assert signature("TT25") == {"verdict": "refused", "refusals": ["terms_one_sided"], "acts": []} + + +def test_no_acts_is_not_within(): + assert signature("TT41") == {"verdict": "undetermined", "refusals": [], "acts": []} + + +def test_the_evaluator_reports_the_agentrust_trace_it_ran_against(): + import agentrust_trace + + out = evaluate("TT01") + assert out["agentrust_trace"] == agentrust_trace.__version__ + pinned = agentrust_trace.__version__ == "0.11.0" + assert ("agentrust_trace_not_the_pinned_version" in out["findings"]) is (not pinned) diff --git a/integrations/horizonshield-musubi-trace-terms/tests/test_trace_terms_vendored.py b/integrations/horizonshield-musubi-trace-terms/tests/test_trace_terms_vendored.py new file mode 100644 index 00000000..c01a3e34 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/tests/test_trace_terms_vendored.py @@ -0,0 +1,76 @@ +"""The vendored files, the evaluator's CLI, and TRACE Level 0 on the consumed records. + +SOURCE_COMMIT is the horizon-shield commit the files were copied from, at +workers/hs-ledger/nenrin/trace-terms-v0/. +""" + +from __future__ import annotations + +import hashlib +import json +import os +import shutil +import subprocess +import sys + +import pytest + +from hs_trace_terms_support import MUSUBI_DIRS, VECTORS, VENDOR + +SOURCE_COMMIT = "05b4924254ebf3c7a5c4523bb2f2fd74ff22b61a" +VENDORED_SHA256 = { + "trace_terms_v0.py": "5fbd7dd7a8d7313973673f2b0593c8b06f7f9f5c01381daf95c8faa81853e069", + "vectors/vectors.json": "a636029b66d66768fbf37ea4e7a61ef0035548d6b0cc407b4c0830a43ac0d38a", +} +# The two Trust Records the vectors consume unchanged, copied from +# agentrust-io/trace-registry (see NOTICE). TT01 uses the first in a +# within_terms verdict, TT16 the second. +REGISTRY_RECORDS = {"TT01": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE", + "TT16": "ff3LjX7m5f7vj3YD5NS_LqtEzEa_wkD5ZnNPBpSD3o8"} + + +def _env(): + env = dict(os.environ) + env["PYTHONPATH"] = os.pathsep.join(MUSUBI_DIRS) + env["PYTHONDONTWRITEBYTECODE"] = "1" + return env + + +def _cli(*args): + return subprocess.run([sys.executable, str(VENDOR / "trace_terms_v0.py"), *args], + capture_output=True, text=True, env=_env(), timeout=600) + + +def test_vendored_files_are_byte_identical_to_the_source_commit(): + for name, digest in VENDORED_SHA256.items(): + assert hashlib.sha256((VENDOR / name).read_bytes()).hexdigest() == digest, name + + +def test_evaluator_selftest_cli_agrees_on_every_vector(): + run = _cli("--selftest") + assert run.returncode == 0, run.stdout + run.stderr + assert run.stdout.strip().splitlines()[-1] == "=== 55 / 55 (musubi-trace-terms-v0) ===" + + +@pytest.mark.parametrize(("vector_id", "exit_code"), [("TT01", 0), ("TT02", 1), ("TT25", 2), ("TT11", 3)]) +def test_check_cli_exit_codes(tmp_path, vector_id, exit_code): + bundle = tmp_path / "bundle.json" + bundle.write_text(json.dumps(VECTORS[vector_id]["bundle"]), encoding="utf-8") + run = _cli("check", str(bundle)) + assert run.returncode == exit_code, run.stdout + run.stderr + + +@pytest.mark.parametrize("vector_id", sorted(REGISTRY_RECORDS)) +def test_consumed_registry_record_passes_trace_level_0(tmp_path, vector_id): + tool = shutil.which("trace-tests", path=os.path.dirname(sys.executable)) or shutil.which("trace-tests") + assert tool, "agentrust-trace-tests is not installed" + record = VECTORS[vector_id]["bundle"]["acts"][0]["trust_record"] + assert record["cnf"]["jwk"]["x"] == REGISTRY_RECORDS[vector_id] + path = tmp_path / "record.json" + path.write_text(json.dumps(record), encoding="utf-8") + # The registry records were issued in August and September 2026; the + # freshness window is opened so the check is about the record, not its age. + run = subprocess.run([tool, "verify", "--record", str(path), "--level", "0", "--max-age", "315360000"], + capture_output=True, text=True, timeout=600) + assert run.returncode == 0, run.stdout + run.stderr + assert "Result: PASS" in run.stdout diff --git a/integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/trace_terms_v0.py b/integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/trace_terms_v0.py new file mode 100644 index 00000000..1eac2a64 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/trace_terms_v0.py @@ -0,0 +1,728 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +""" +musubi-trace-terms-v0: TRACE says each call was allowed and what ran it. This says whether the calls the +contractor signed, taken together, kept the contract both parties signed. + +A TRACE authorization (agentrust-trace, profile pic-trace-bridge-v1) is one signed decision for one +tool call, checked at the moment of the call. A TRACE Trust Record is one runtime's statement of what +ran (model, policy bundle, platform, data class, build). Neither says what two parties agreed, and +neither adds anything up. This layer takes both as evidence, unchanged, under an a2a-contract-v0 that +both parties signed, and answers four questions about the presented acts that anyone can recompute: + + 1. Was every executed call authorized by an authorizer the principal agreed to, under a decision + TRACE's own verifier accepts? (verify_bridge from agentrust-trace, not a reimplementation) + 2. Was every tool, mapped to the contract's actions, inside the grant? A bridge scope may be wider + than the contract; the contract wins. + 3. Did the calls together stay within the counts the parties agreed? Every call can be allowed and + the fifth still be one too many. + 4. When the parties agreed on the runtime, does the Trust Record each act names come from an agreed + producer, about an agreed agent, and state that runtime? + +The contractor's act commits by digest to every piece of evidence the verdict reads. Evidence that is +missing or is not what the act names makes the act undetermined, never outside the terms: whoever +assembles a bundle cannot make the contractor look outside the terms by swapping what it did not sign. +It reads, it does not run anything, and it never fetches. What a verdict does not establish is in +SPEC.md section 8: above all, it says nothing about acts that were not presented, and a Trust Record's +claims are its producer's statements; nothing here appraises a hardware attestation. + +CLI: + python3 trace_terms_v0.py check bundle.json prints the evaluation, exit 0 within_terms, + 1 outside_terms, 2 refused, 3 undetermined + python3 trace_terms_v0.py --selftest reruns vectors/vectors.json +""" +import base64 +import calendar +import hashlib +import json +import os +import sys + +HERE = os.path.dirname(os.path.abspath(__file__)) +for _p in (os.path.join(HERE, "..", "musubi-v0"), os.path.join(HERE, "..", "agreement-v0"), + os.path.join(HERE, "..", "sdk-python", "src")): + _p = os.path.normpath(_p) + if _p not in sys.path: + sys.path.insert(0, _p) + +import contract_v0 as C # noqa: E402 +from agreement_verify import canonical, ed25519_verify, norm_domain, parse_strict # noqa: E402 +from nenrin_verify import trace as NT # noqa: E402 + +VERSION = "0.1.0" +TERMS_SCHEMA = "musubi-trace-terms-v0" +ACT_SCHEMA = "musubi-trace-act-v0" +EVAL_SCHEMA = "musubi-trace-terms-eval-v0" +TERMS_CONTEXT = b"musubi-trace-terms-v0\n" +ACT_CONTEXT = b"musubi-trace-act-v0\n" +BRIDGE_PROFILE = "tag:agentrust-io.com,2026:pic-trace-bridge-v1" +AGENTRUST_TRACE_PIN = "0.11.0" +DEFAULT_MAX_AGE = 86400 +MAX_ACTS = 1024 +MAX_JWKS = 64 +# grant clauses this profile does not judge. A contract carrying one is refused rather than judged as if the +# clause were not there: use settle (contract_v0 and the settle layers) for those. +UNJUDGED_GRANT = ("conditional", "limits", "approval_policy", "data_access", "expiry_height") +# requirements this profile does not judge either: an evidence or recovery requirement other than "n/a", an +# admission requirement, or any requirement it does not know. Settle judges those. +JUDGED_REQUIREMENTS = {"evidence": "n/a", "recovery": "n/a"} + + +def _utc(v): + """Seconds since the epoch for an "YYYY-MM-DDTHH:MM:SSZ" string, None otherwise.""" + if not (isinstance(v, str) and len(v) == 20 and v[4] == "-" and v[7] == "-" and v[10] == "T" + and v[13] == ":" and v[16] == ":" and v[19] == "Z"): + return None + try: + import time as _t + return calendar.timegm(_t.strptime(v, "%Y-%m-%dT%H:%M:%SZ")) + except Exception: + return None +SAFE = 2 ** 53 - 1 + +TERMS_KEYS = {"schema", "contract_sha256", "authorizers", "tools", "max_calls", "max_calls_total", "runtime", + "signatures"} +RUNTIME_KEYS = {"producers", "subjects", "models", "policy_bundle_hashes", "enforcement_mode", "data_classes", + "platforms", "min_slsa_level", "appraisal_status", "max_age_seconds"} +ACT_KEYS = {"schema", "contract_sha256", "seq", "bridge_sha256", "tool_call_digest", "declaration_digest", + "pic_intent_digest", "pic_args_digest", "transcript_digest", "trace_sha256", "executed_at", + "signatures"} +ITEM_KEYS = {"act", "bridge", "declaration", "pic_intent_digest", "pic_args_digest", "tool_call", "transcript", + "trust_record"} +BUNDLE_KEYS = {"contract", "terms", "authorizer_jwks", "acts"} + +# Codes that put an attributed act outside the terms: each rests only on what the contractor signed and on +# signatures nobody else can forge. Every other code leaves the act undetermined. +DEVIATIONS = { + "seq_conflict", "executed_before_agreed_at", "executed_after_expiry", "authorizer_not_agreed", "authorization_denied", "authorization_mismatch", + "authorization_invalid", "executed_without_valid_authorization", "tool_not_in_terms", "prohibited_action", + "action_not_granted", "authorization_reused", "calls_exceed_terms", "runtime_evidence_not_named", + "trace_refused", "producer_not_agreed", "subject_not_agreed", "model_not_agreed", "policy_not_agreed", + "enforcement_not_agreed", "data_class_not_agreed", "platform_not_agreed", "slsa_below_terms", + "appraisal_not_agreed", "trace_stale_at_act", +} +UNDETERMINED = {"evidence_not_as_signed", "authorizer_key_not_supplied", "runtime_evidence_missing"} + + +def _is_int(v): + return isinstance(v, int) and not isinstance(v, bool) + + +def _sha_hex(b): + return hashlib.sha256(b).hexdigest() + + +def _hex64(v): + return isinstance(v, str) and len(v) == 64 and all(c in "0123456789abcdef" for c in v) + + +def _trace_digest(v): + return isinstance(v, str) and v.startswith("sha256:") and _hex64(v[7:]) + + +def _thumb(v): + return isinstance(v, str) and len(v) == 43 and all( + c in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" for c in v) + + +def _strlist(v, nonempty=False): + return (isinstance(v, list) and all(isinstance(x, str) and x for x in v) and len(set(v)) == len(v) + and (len(v) > 0 or not nonempty)) + + +def terms_signing_bytes(terms): + return TERMS_CONTEXT + canonical({k: v for k, v in terms.items() if k != "signatures"}).encode("utf-8") + + +def act_signing_bytes(act): + return ACT_CONTEXT + canonical({k: v for k, v in act.items() if k != "signatures"}).encode("utf-8") + + +def trace_jcs_digest(obj): + """sha256: of RFC 8785, the digest TRACE's own bridge uses (agentrust_trace.intent_bridge.digest_jcs). + Raises NT.Refusal when the value has no RFC 8785 form.""" + return "sha256:" + _sha_hex(NT.jcs(obj).encode("utf-8")) + + +def bridge_sha256(bridge): + """The act names the whole signed bridge object, signature included, by the hex sha256 of its RFC 8785 bytes.""" + return _sha_hex(NT.jcs(bridge).encode("utf-8")) + + +def _normal(v): + """The value its RFC 8785 digest names: 1790000030.0 and 1790000030 have one digest, so every reader here and + in TRACE sees the integer. Without this, whoever assembles a bundle could rewrite an integer as an equal float, + keep every digest and signature valid, and make a strict reader reject what the contractor signed.""" + return json.loads(NT.jcs(v)) + + +def _canon_ok(v): + try: + NT.jcs(v) + return True + except Exception: + return False + + +# --------------------------------------------------------------------------- stage A: contract and terms +def _terms_problems(t): + p = [] + if not isinstance(t, dict): + return ["terms_malformed:not_object"] + if t.get("schema") != TERMS_SCHEMA: + return ["terms_schema"] + if set(t.keys()) != TERMS_KEYS: + return ["terms_malformed:members"] + if not _hex64(t["contract_sha256"]): + p.append("terms_malformed:contract_sha256") + if not (_strlist(t["authorizers"], nonempty=True) and all(_thumb(x) for x in t["authorizers"])): + p.append("terms_malformed:authorizers") + tools = t["tools"] + tools_ok = isinstance(tools, dict) and tools and all(isinstance(k, str) and k and isinstance(v, str) and v + for k, v in tools.items()) + if not tools_ok: + p.append("terms_malformed:tools") + mc = t["max_calls"] + if not (isinstance(mc, dict) and all(isinstance(k, str) and k and _is_int(v) and 1 <= v <= SAFE + for k, v in mc.items())): + p.append("terms_malformed:max_calls") + elif tools_ok and any(k not in set(tools.values()) for k in mc): + # a cap on a name no tool maps to would never apply, and nobody reading the terms would see that + p.append("terms_malformed:max_calls_unknown_action") + mt = t["max_calls_total"] + if not (mt is None or (_is_int(mt) and 1 <= mt <= SAFE)): + p.append("terms_malformed:max_calls_total") + rt = t["runtime"] + if rt is not None: + if not isinstance(rt, dict) or set(rt.keys()) != RUNTIME_KEYS: + p.append("terms_malformed:runtime") + else: + if not (_strlist(rt["producers"], nonempty=True) and all(_thumb(x) for x in rt["producers"])): + p.append("terms_malformed:runtime.producers") + if not _strlist(rt["subjects"], nonempty=True): + p.append("terms_malformed:runtime.subjects") + m = rt["models"] + if not (m is None or (isinstance(m, list) and m and all( + isinstance(x, dict) and set(x.keys()) == {"provider", "model_id"} and + all(isinstance(x[k], str) and x[k] for k in x) for x in m))): + p.append("terms_malformed:runtime.models") + for f in ("policy_bundle_hashes", "data_classes", "platforms", "appraisal_status"): + if not (rt[f] is None or _strlist(rt[f], nonempty=True)): + p.append("terms_malformed:runtime." + f) + if rt["enforcement_mode"] is not None and not (isinstance(rt["enforcement_mode"], str) + and rt["enforcement_mode"]): + p.append("terms_malformed:runtime.enforcement_mode") + s = rt["min_slsa_level"] + if not (s is None or (_is_int(s) and 0 <= s <= 4)): + p.append("terms_malformed:runtime.min_slsa_level") + a = rt["max_age_seconds"] + if not (a is None or (_is_int(a) and 0 <= a <= 31536000)): + p.append("terms_malformed:runtime.max_age_seconds") + if not isinstance(t["signatures"], list): + p.append("terms_malformed:signatures") + if not p and not _canon_ok({k: v for k, v in t.items() if k != "signatures"}): + p.append("terms_malformed:not_canonical") + return p + + +def _terms_signature_problems(terms, contract): + """Both contract parties, by the keys the contract pins, over the terms' signing bytes. The same rule + contract_v0.verify_contract applies to the contract itself.""" + pin = {norm_domain(p.get("domain")): p.get("public_key_ed25519_b64") + for p in (contract.get("parties") or []) if isinstance(p, dict)} + msg = terms_signing_bytes(terms) + signed, out = set(), [] + for s in terms["signatures"]: + if not isinstance(s, dict) or set(s.keys()) != {"domain", "alg", "signature"} or s.get("alg") != "ed25519": + out.append("terms_signature_malformed") + continue + d = norm_domain(s.get("domain")) + if d not in pin: + out.append("terms_stranger_signature") + continue + if ed25519_verify(pin[d], s.get("signature"), msg) is True: + signed.add(d) + else: + out.append("terms_bad_signature") + if any(d not in signed for d in pin): + out.append("terms_one_sided") + return sorted(set(out)) + + +def _contractor_key(contract): + for p in contract.get("parties") or []: + if isinstance(p, dict) and p.get("role") == "contractor": + return p.get("public_key_ed25519_b64") + return None + + +# --------------------------------------------------------------------------- one act +def _act_shape(act): + if not isinstance(act, dict) or act.get("schema") != ACT_SCHEMA or set(act.keys()) != ACT_KEYS: + return False + return (_hex64(act["contract_sha256"]) and _is_int(act["seq"]) and 1 <= act["seq"] <= SAFE + and _hex64(act["bridge_sha256"]) and _trace_digest(act["tool_call_digest"]) + and _trace_digest(act["declaration_digest"]) and isinstance(act["pic_intent_digest"], str) + and isinstance(act["pic_args_digest"], str) + and (act["transcript_digest"] is None or _trace_digest(act["transcript_digest"])) + and (act["trace_sha256"] is None or _hex64(act["trace_sha256"])) + and _is_int(act["executed_at"]) and 1700000000 <= act["executed_at"] <= SAFE + and isinstance(act["signatures"], list) and _canon_ok({k: v for k, v in act.items() if k != "signatures"})) + + +def _signed_by(act, key_b64): + if not key_b64 or not isinstance(act, dict) or not isinstance(act.get("signatures"), list): + return False + try: + msg = act_signing_bytes(act) + except Exception: + return False + for s in act["signatures"]: + if (isinstance(s, dict) and set(s.keys()) == {"role", "sig_b64"} and s.get("role") == "contractor" + and ed25519_verify(key_b64, s.get("sig_b64"), msg) is True): + return True + return False + + +def _bridge_signature_verifies(bridge, jwk): + """Ed25519 over RFC 8785 of {"profile", "authorization"}: the bytes agentrust-trace's sign_bridge signs. Used + only to tell who signed a bridge; whether the bridge allows the call is TRACE's verify_bridge's answer.""" + try: + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey + if not (isinstance(jwk, dict) and jwk.get("kty") == "OKP" and jwk.get("crv") == "Ed25519"): + return False + x = NT._b64url_canonical(jwk.get("x")) + sig = NT._b64url_canonical(bridge.get("signature")) + if x is None or len(x) != 32 or sig is None or len(sig) != 64: + return False + body = NT.jcs({"profile": bridge["profile"], "authorization": bridge["authorization"]}).encode("utf-8") + Ed25519PublicKey.from_public_bytes(x).verify(sig, body) + return True + except Exception: + return False + + +def _thumbprint(jwk): + try: + from agentrust_trace.sign import jwk_thumbprint + return jwk_thumbprint(jwk) + except Exception: + return None + + +def _authorizer(bridge, jwks, agreed): + """Which supplied key signed this bridge. Returns (jwk, thumbprint, code): code None for an agreed key, + authorizer_not_agreed when only a key the terms do not list verifies it, authorizer_key_not_supplied when no + supplied key verifies it (undetermined: the relying party did not hand over the key).""" + auth = bridge.get("authorization") if isinstance(bridge, dict) else None + kid = auth.get("authorizer_key_id") if isinstance(auth, dict) else None + cands = [(j, _thumbprint(j)) for j in jwks if isinstance(kid, str) and j.get("kid") == kid] + for j, tp in cands: + if tp is not None and tp in agreed and _bridge_signature_verifies(bridge, j): + return j, tp, None + for j, tp in cands: + if tp is not None and tp not in agreed and _bridge_signature_verifies(bridge, j): + return j, tp, "authorizer_not_agreed" + return None, None, "authorizer_key_not_supplied" + + +def _verify_bridge(item, jwk, now): + """TRACE's own verifier decides whether the decision allows this call. Returns ([codes], why).""" + from agentrust_trace import intent_bridge as IB + try: + IB.verify_bridge(item["bridge"], jwk, declaration=item["declaration"], + pic_intent_digest=item["pic_intent_digest"], pic_args_digest=item["pic_args_digest"], + tool_call=item["tool_call"], transcript=item["transcript"], now=now) + return [], None + except IB.AuthorizationDenied as e: + return ["authorization_denied", "executed_without_valid_authorization"], str(e) + except IB.AuthorizationMismatch as e: + return ["authorization_mismatch", "executed_without_valid_authorization"], str(e) + except IB.IntentBridgeError as e: + return ["authorization_invalid", "executed_without_valid_authorization"], str(e) + except Exception as e: # anything TRACE's verifier raises that is not its own error type + return ["authorization_invalid", "executed_without_valid_authorization"], "%s: %s" % (type(e).__name__, e) + + +def _evidence_mismatches(item, act): + """Each piece of evidence the act commits to, compared with what the bundle carries. A mismatch means the + bundle does not hold what the contractor signed: the act is undetermined, never outside the terms.""" + bad = [] + if bridge_sha256(item["bridge"]) != act["bridge_sha256"]: + bad.append("bridge") + if trace_jcs_digest(item["tool_call"]) != act["tool_call_digest"]: + bad.append("tool_call") + if trace_jcs_digest(item["declaration"]) != act["declaration_digest"]: + bad.append("declaration") + if item["pic_intent_digest"] != act["pic_intent_digest"]: + bad.append("pic_intent_digest") + if item["pic_args_digest"] != act["pic_args_digest"]: + bad.append("pic_args_digest") + if act["transcript_digest"] is None: + if item["transcript"] is not None: + bad.append("transcript") + elif item["transcript"] is None or trace_jcs_digest(item["transcript"]) != act["transcript_digest"]: + bad.append("transcript") + return bad + + +def _runtime_check(R, act, rt): + """Section 6. The Trust Record is checked as the NENRIN ledger's intake checks it, at the stated act time, + then its claims are compared with what both parties agreed. Equality only; nothing is appraised. + The caller has already established that R is the record the act names.""" + codes, info = [], {} + try: + c = NT.check_trace_record(R, act["executed_at"]) + except NT.Refusal as e: + return ["trace_refused"], {"trace_refusal": e.code} + except Exception as e: + return ["trace_refused"], {"trace_refusal": type(e).__name__} + info["producer"] = c["key_thumbprint"] + if c["key_thumbprint"] not in rt["producers"]: + codes.append("producer_not_agreed") + if c["subject"] not in rt["subjects"]: + codes.append("subject_not_agreed") + model = R.get("model") if isinstance(R.get("model"), dict) else {} + if rt["models"] is not None and not any(model.get("provider") == m["provider"] and + model.get("model_id") == m["model_id"] for m in rt["models"]): + codes.append("model_not_agreed") + pol = R.get("policy") if isinstance(R.get("policy"), dict) else {} + if rt["policy_bundle_hashes"] is not None and pol.get("bundle_hash") not in rt["policy_bundle_hashes"]: + codes.append("policy_not_agreed") + if rt["enforcement_mode"] is not None and pol.get("enforcement_mode") != rt["enforcement_mode"]: + codes.append("enforcement_not_agreed") + if rt["data_classes"] is not None and R.get("data_class") not in rt["data_classes"]: + codes.append("data_class_not_agreed") + run = R.get("runtime") if isinstance(R.get("runtime"), dict) else {} + if rt["platforms"] is not None and run.get("platform") not in rt["platforms"]: + codes.append("platform_not_agreed") + bp = R.get("build_provenance") if isinstance(R.get("build_provenance"), dict) else {} + if rt["min_slsa_level"] is not None: + lvl = bp.get("slsa_level") + if not (_is_int(lvl) and lvl >= rt["min_slsa_level"]): + codes.append("slsa_below_terms") + ap = R.get("appraisal") if isinstance(R.get("appraisal"), dict) else {} + if rt["appraisal_status"] is not None and ap.get("status") not in rt["appraisal_status"]: + codes.append("appraisal_not_agreed") + max_age = DEFAULT_MAX_AGE if rt["max_age_seconds"] is None else rt["max_age_seconds"] + if act["executed_at"] - c["iat"] > max_age: + codes.append("trace_stale_at_act") + return codes, info + + +def _item_readable(item): + if not (isinstance(item, dict) and set(item.keys()) == ITEM_KEYS and _act_shape(item["act"]) + and isinstance(item["bridge"], dict) and isinstance(item["tool_call"], dict) + and isinstance(item["declaration"], dict) + and isinstance(item["pic_intent_digest"], str) and isinstance(item["pic_args_digest"], str) + and (item["transcript"] is None or isinstance(item["transcript"], dict)) + and (item["trust_record"] is None or isinstance(item["trust_record"], dict))): + return False + # every TRACE object the verdict digests must have an RFC 8785 form + return all(_canon_ok(item[k]) for k in ("bridge", "tool_call", "declaration")) and \ + (item["transcript"] is None or _canon_ok(item["transcript"])) + + +# --------------------------------------------------------------------------- the evaluation +def _refused(out, codes): + out["verdict"], out["refusals"] = "refused", sorted(set(codes)) + return out + + +def evaluate(bundle): + out = {"schema": EVAL_SCHEMA, "evaluator": "trace_terms_v0.py " + VERSION, + "agentrust_trace": None, "verdict": None, "refusals": [], "acts": [], "counts": {}, "findings": []} + try: + import agentrust_trace + out["agentrust_trace"] = getattr(agentrust_trace, "__version__", None) + except Exception: + return _refused(out, ["agentrust_trace_missing"]) + if out["agentrust_trace"] != AGENTRUST_TRACE_PIN: + out["findings"].append("agentrust_trace_not_the_pinned_version") + + if not isinstance(bundle, dict) or set(bundle.keys()) != BUNDLE_KEYS: + return _refused(out, ["bundle_malformed"]) + contract, terms = bundle["contract"], bundle["terms"] + try: + cv = C.verify_contract(contract) + except Exception: + return _refused(out, ["contract:unreadable"]) + if cv.get("verdict") != "accepted": + return _refused(out, ["contract:" + r["code"] for r in cv["refusals"]]) + csha = cv["contract_sha256"] + out["contract_sha256"] = csha + g0 = contract.get("grant") or {} + unj = ["grant_clause_not_judged:" + k for k in UNJUDGED_GRANT if g0.get(k) not in (None, [], {})] + if contract.get("parent_contract") is not None: + unj.append("contract_clause_not_judged:parent_contract") + rq = contract.get("requirements") + if not isinstance(rq, dict): + unj.append("contract_clause_not_judged:requirements") + else: + for k, v in rq.items(): + if JUDGED_REQUIREMENTS.get(k) != v: + unj.append("contract_clause_not_judged:requirements." + str(k)) + agreed_at = _utc(contract.get("agreed_at")) + if agreed_at is None: + unj.append("contract_clause_not_judged:agreed_at") + expiry = None + if contract.get("expiry") is not None: + expiry = _utc(contract.get("expiry")) + if expiry is None: + unj.append("contract_clause_not_judged:expiry") + if unj: + return _refused(out, unj) + tp = _terms_problems(terms) + if tp: + return _refused(out, tp) + if terms["contract_sha256"] != csha: + return _refused(out, ["terms_for_other_contract"]) + sp = _terms_signature_problems(terms, contract) + if sp: + return _refused(out, sp) + jw, acts = bundle["authorizer_jwks"], bundle["acts"] + if not (isinstance(jw, list) and len(jw) <= MAX_JWKS and all(isinstance(j, dict) for j in jw)): + return _refused(out, ["bundle_malformed:authorizer_jwks"]) + if not (isinstance(acts, list) and len(acts) <= MAX_ACTS): + return _refused(out, ["bundle_malformed:acts"]) + out["terms_sha256"] = _sha_hex(terms_signing_bytes(terms)) + + grant = contract.get("grant") or {} + authorized = set(grant.get("authorized_actions") or []) + prohibited = set(grant.get("prohibited_actions") or []) + agreed = set(terms["authorizers"]) + ckey = _contractor_key(contract) + rt = terms["runtime"] + + rows = [] + for i, item in enumerate(acts): + row = {"index": i, "seq": None, "status": None, "codes": []} + rows.append(row) + signed = isinstance(item, dict) and _signed_by(item.get("act"), ckey) + if not _item_readable(item): + # a contractor-signed act that is not well formed is still the contractor's: undetermined, not dropped. + # Anything else unreadable is nobody's act and is only reported. + if signed: + row["status"], row["codes"] = "unreadable", ["act_malformed", "signed_by_contractor"] + else: + row["status"], row["codes"] = "not_attributed", ["act_malformed"] + continue + item = dict(item) + for k in ("bridge", "tool_call", "declaration", "transcript"): + if item[k] is not None: + item[k] = _normal(item[k]) + if item["trust_record"] is not None and _canon_ok(item["trust_record"]): + item["trust_record"] = _normal(item["trust_record"]) + act = item["act"] + row["seq"] = act["seq"] + if not signed: + row["status"], row["codes"] = "not_attributed", ["act_not_signed_by_contractor"] + continue + if act["contract_sha256"] != csha: + row["status"], row["codes"] = "other_contract", ["contractor_act_for_other_contract"] + continue + row["status"] = "attributed" + row["_item"] = item + row["_bytes"] = act_signing_bytes(act) + + # Attributed acts in the contractor's own order. The same act bytes twice count once; two different acts the + # contractor signed with one seq are both read, both counted, and both outside the terms. + def _matches(r): + """Every piece of evidence is the one the act names, the Trust Record included.""" + it, a = r["_item"], r["_item"]["act"] + try: + if _evidence_mismatches(it, a): + return False + if a["trace_sha256"] is None: + return it["trust_record"] is None + return it["trust_record"] is not None and _canon_ok(it["trust_record"]) and \ + NT.sha256hex(NT.jcs(it["trust_record"])) == a["trace_sha256"] + except Exception: + return False + # within one set of identical act bytes, the copy whose evidence matches what the act names is read first, so + # neither the order of the list nor a second copy with other evidence decides the verdict + attributed = sorted((r for r in rows if r["status"] == "attributed"), + key=lambda r: (r["seq"], r["_bytes"], 0 if _matches(r) else 1, r["index"])) + by_seq = {} + for r in attributed: + by_seq.setdefault(r["seq"], set()).add(r["_bytes"]) + seen_bytes, seen_auth = set(), set() + per_action, total = {}, 0 + for r in attributed: + item, b = r.pop("_item"), r.pop("_bytes") + act = item["act"] + if b in seen_bytes: + r["status"], r["codes"] = "duplicate", ["same_act_again"] + continue + seen_bytes.add(b) + codes, why = [], {} + if len(by_seq[act["seq"]]) > 1: + codes.append("seq_conflict") + bad = _evidence_mismatches(item, act) + if bad: + codes.append("evidence_not_as_signed") + why["evidence_not_as_signed"] = bad + else: + jwk, thumb, acode = _authorizer(item["bridge"], bundle["authorizer_jwks"], agreed) + if acode == "authorizer_key_not_supplied": + codes.append(acode) + else: + if acode == "authorizer_not_agreed": + codes += ["authorizer_not_agreed", "executed_without_valid_authorization"] + bc, bwhy = _verify_bridge(item, jwk, act["executed_at"]) + codes += bc + if bwhy: + why["authorization"] = bwhy + aid = item["bridge"]["authorization"].get("authorization_id") + if isinstance(aid, str): + if (thumb, aid) in seen_auth: + codes.append("authorization_reused") + seen_auth.add((thumb, aid)) + tool = item["tool_call"].get("name") + action = terms["tools"].get(tool) if isinstance(tool, str) else None + r["tool"] = tool if isinstance(tool, str) else None + r["action"] = action + if not bad: + if action is None: + codes.append("tool_not_in_terms") + elif action in prohibited: + codes.append("prohibited_action") + elif action not in authorized: + codes.append("action_not_granted") + # every attributed act counts toward the total, valid or not: the contractor signed that it ran. Its + # action is known only when the tool call is the one the act names; otherwise it counts as unverified, + # so a swapped tool call cannot move a count from one action to another. + total += 1 + if bad: + key = "unverified" + else: + key = action if action is not None else ("tool:" + tool if isinstance(tool, str) else "tool:?") + per_action[key] = per_action.get(key, 0) + 1 + if act["executed_at"] < agreed_at: + codes.append("executed_before_agreed_at") + if expiry is not None and act["executed_at"] >= expiry: + codes.append("executed_after_expiry") + if (not bad and action is not None and action in terms["max_calls"] + and per_action[key] > terms["max_calls"][action]) \ + or (terms["max_calls_total"] is not None and total > terms["max_calls_total"]): + codes.append("calls_exceed_terms") + if rt is not None: + if act["trace_sha256"] is None: + codes.append("runtime_evidence_not_named") + elif item["trust_record"] is None or not _canon_ok(item["trust_record"]) or \ + NT.sha256hex(NT.jcs(item["trust_record"])) != act["trace_sha256"]: + codes.append("runtime_evidence_missing") + else: + rc, info = _runtime_check(item["trust_record"], act, rt) + codes += rc + if info: + why.update(info) + elif item["trust_record"] is not None: + r["findings"] = ["runtime_not_in_terms_record_not_read"] + codes = sorted(set(codes)) + r["codes"] = codes + if why: + r["why"] = why + if any(c in DEVIATIONS for c in codes): + r["status"] = "outside_terms" + elif any(c in UNDETERMINED for c in codes): + r["status"] = "undetermined" + else: + r["status"] = "within_terms" + + out["acts"] = rows + st = [r["status"] for r in rows] + out["counts"] = {"acts": len(rows), "counted_calls": total, "per_action": dict(sorted(per_action.items())), + "within_terms": st.count("within_terms"), "outside_terms": st.count("outside_terms"), + "undetermined": st.count("undetermined"), "not_attributed": st.count("not_attributed"), + "other_contract": st.count("other_contract"), "duplicate": st.count("duplicate"), + "unreadable": st.count("unreadable")} + if "outside_terms" in st: + out["verdict"] = "outside_terms" + elif any(s in ("undetermined", "unreadable", "other_contract") for s in st) or total == 0: + out["verdict"] = "undetermined" + else: + out["verdict"] = "within_terms" + if total == 0: + out["findings"].append("no_attributed_acts") + if "not_attributed" in st: + out["findings"].append("acts_not_signed_by_the_contractor_are_reported_not_counted") + out["findings"] += ["only_the_presented_acts_are_judged", "executed_at_is_the_contractors_statement", + "pic_digests_compared_not_recomputed", + "trust_record_claims_are_producer_statements_not_appraised"] + out["findings"] = sorted(set(out["findings"])) + return out + + +# --------------------------------------------------------------------------- signing helpers (for builders) +def sign_terms(terms, priv, domain): + """Append one party's signature. priv is an Ed25519PrivateKey.""" + terms["signatures"] = [s for s in terms.get("signatures") or []] + sig = priv.sign(terms_signing_bytes(terms)) + terms["signatures"].append({"domain": domain, "alg": "ed25519", + "signature": base64.b64encode(sig).decode("ascii")}) + return terms + + +def make_act(contract_sha, seq, item, executed_at, trust_record=None): + """The act a contractor signs for one executed call, committing to every piece of evidence by digest.""" + return {"schema": ACT_SCHEMA, "contract_sha256": contract_sha, "seq": seq, + "bridge_sha256": bridge_sha256(item["bridge"]), "tool_call_digest": trace_jcs_digest(item["tool_call"]), + "declaration_digest": trace_jcs_digest(item["declaration"]), + "pic_intent_digest": item["pic_intent_digest"], "pic_args_digest": item["pic_args_digest"], + "transcript_digest": None if item.get("transcript") is None else trace_jcs_digest(item["transcript"]), + "trace_sha256": None if trust_record is None else NT.sha256hex(NT.jcs(trust_record)), + "executed_at": executed_at, "signatures": []} + + +def sign_act(act, priv): + act["signatures"] = [] + sig = priv.sign(act_signing_bytes(act)) + act["signatures"] = [{"role": "contractor", "sig_b64": base64.b64encode(sig).decode("ascii")}] + return act + + +def _signature(ev): + """What the vectors compare: verdict, stage A refusals, and per act (index, status, sorted codes).""" + return {"verdict": ev["verdict"], "refusals": ev["refusals"], + "acts": [{"index": r["index"], "status": r["status"], "codes": r["codes"]} for r in ev["acts"]]} + + +def selftest(): + with open(os.path.join(HERE, "vectors", "vectors.json"), encoding="utf-8") as f: + doc = parse_strict(f.read()) + fails = 0 + for v in doc["vectors"]: + got = _signature(evaluate(v["bundle"])) + ok = got == v["expect"] + fails += 0 if ok else 1 + print((" ok " if ok else " FAIL ") + v["id"] + " " + v["title"]) + if not ok: + print(" want " + json.dumps(v["expect"], sort_keys=True)) + print(" got " + json.dumps(got, sort_keys=True)) + n = len(doc["vectors"]) + print("\n=== %d / %d (musubi-trace-terms-v0) ===" % (n - fails, n)) + return 1 if fails else 0 + + +def main(argv): + if argv[1:2] == ["--selftest"]: + return selftest() + if len(argv) == 3 and argv[1] == "check": + with open(argv[2], encoding="utf-8") as f: + text = f.read() + try: + bundle = parse_strict(text) + except Exception as e: + print(json.dumps({"schema": EVAL_SCHEMA, "verdict": "refused", + "refusals": ["bundle_not_strict_json"], "why": type(e).__name__})) + return 2 + ev = evaluate(bundle) + print(json.dumps(ev, indent=2, sort_keys=True, ensure_ascii=False)) + return {"within_terms": 0, "outside_terms": 1, "refused": 2, "undetermined": 3}[ev["verdict"]] + print(__doc__.strip().split("CLI:")[1]) + return 64 + + +if __name__ == "__main__": + sys.exit(main(sys.argv)) diff --git a/integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/vectors/vectors.json b/integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/vectors/vectors.json new file mode 100644 index 00000000..f274a914 --- /dev/null +++ b/integrations/horizonshield-musubi-trace-terms/vendor/trace-terms-v0/vectors/vectors.json @@ -0,0 +1,16030 @@ +{ + "agentrust_trace": "0.11.0", + "generator": "gen_vectors.py", + "schema": "musubi-trace-terms-vectors-v0", + "sources": { + "bernstein-3.20.0-20260920-165918-backend-99365805.json": "bd39b2ecdea66b20e186663e24cd0217eab3f458256ef607ed2111a965481efb", + "summit-demo-record.json": "d9fbf07c7813b10da4cacdfda4260ba829178409a26829dbcdb4512eac08a51c" + }, + "vectors": [ + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "7dbf89b0b480f6dacf3e1074340a64d6b62bb522559f104dd7481704e1c04796", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "7XQEoN5WP1oeBTlA3aQqqMzIXiGEr7N1R6lqioZDGSVdzBHaGqwH04N69RlAY08dhPO2IHc3h/mhq5tf2L4bCQ==" + } + ], + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "iQiXa2j3cTxQ_cx4Kcos2fFSD-fwbQt8oYPPqeYBjrLu_aNJq60J3P5BTxfH2p_ntkTWaHb0zlHlOBAvQH6RDw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "46b0d897f34e0e67a8423b313feeef1b665ad9011f9499a178bd8de32f223bee", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:06706ded4551e893719bc9a196ad248626f7384f8c1c15e75c9dfe010ee1a304", + "executed_at": 1787244857, + "pic_args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "pic_intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "schema": "musubi-trace-act-v0", + "seq": 3, + "signatures": [ + { + "role": "contractor", + "sig_b64": "0JkIMDuifpMf9SiOmkz00voeImizG/ulRAnrKC/XGyXyC64cKmYjFgkSzBbBNauNhsaz1iuQjGmQJ2dPHfvhDg==" + } + ], + "tool_call_digest": "sha256:54b1975e0b30c340d172dffcb80f62259980098a3dc3d1d8ff74f98faf6f8d5a", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-003", + "authorized_at": 1787244827, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:06706ded4551e893719bc9a196ad248626f7384f8c1c15e75c9dfe010ee1a304", + "expires_at": 1787245427, + "pic": { + "args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:54b1975e0b30c340d172dffcb80f62259980098a3dc3d1d8ff74f98faf6f8d5a", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "jQ3i-o3UaJ7Dp65YfyhsPggE_fukYv1TdyF8TPVf0VlY_uTPsBM1qL3WyoRyC0wyofhMwo5FHPAfHHz4n2ysAA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 3" + }, + "pic_args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "pic_intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-003" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": { + "audit": 2 + }, + "max_calls_total": 3, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "qDGt8AlE7bohnzvPEdVHzvCPP4NQUw487MwE8xKSbx8t5UpMbbh24RsTexXN07XAqRqGa8+CKV8aYPdTSMsFAQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "a3dD5nWcT2tJdqSj+sRcrTZF1lqS2o50peKLQug8a2+8Wdx4BdWQA/NrygM074t2eSI9M3H0dSyOEH7JlZ5hAg==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + }, + { + "codes": [], + "index": 2, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT01", + "title": "three calls, each allowed by TRACE, inside the grant and the counts, on the agreed runtime" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "bc9fa9182a03fd727d23e1ee67500575c2dee9c6b7d7ee987be8bf02081e0d2a", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "TUe+IK7RKJk9Xz8WvmyH2BGKAaUM4larlsMteqlfkC6NCVWyP7rrLtJ5AaVwn9ryH0XjIze5WpD9yyxWZmzOBw==" + } + ], + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "feJHRSxH-8P3WJ4vSdKW4pHLGFonPXZssMrwZXtyAKKwTeG_EPfg2Q0jk5LFeb-j6JXDcxQISImfAdRWcrv_Dg" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "7dbf89b0b480f6dacf3e1074340a64d6b62bb522559f104dd7481704e1c04796", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "7XQEoN5WP1oeBTlA3aQqqMzIXiGEr7N1R6lqioZDGSVdzBHaGqwH04N69RlAY08dhPO2IHc3h/mhq5tf2L4bCQ==" + } + ], + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "iQiXa2j3cTxQ_cx4Kcos2fFSD-fwbQt8oYPPqeYBjrLu_aNJq60J3P5BTxfH2p_ntkTWaHb0zlHlOBAvQH6RDw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "46b0d897f34e0e67a8423b313feeef1b665ad9011f9499a178bd8de32f223bee", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:06706ded4551e893719bc9a196ad248626f7384f8c1c15e75c9dfe010ee1a304", + "executed_at": 1787244857, + "pic_args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "pic_intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "schema": "musubi-trace-act-v0", + "seq": 3, + "signatures": [ + { + "role": "contractor", + "sig_b64": "0JkIMDuifpMf9SiOmkz00voeImizG/ulRAnrKC/XGyXyC64cKmYjFgkSzBbBNauNhsaz1iuQjGmQJ2dPHfvhDg==" + } + ], + "tool_call_digest": "sha256:54b1975e0b30c340d172dffcb80f62259980098a3dc3d1d8ff74f98faf6f8d5a", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-003", + "authorized_at": 1787244827, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:06706ded4551e893719bc9a196ad248626f7384f8c1c15e75c9dfe010ee1a304", + "expires_at": 1787245427, + "pic": { + "args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:54b1975e0b30c340d172dffcb80f62259980098a3dc3d1d8ff74f98faf6f8d5a", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "jQ3i-o3UaJ7Dp65YfyhsPggE_fukYv1TdyF8TPVf0VlY_uTPsBM1qL3WyoRyC0wyofhMwo5FHPAfHHz4n2ysAA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 3" + }, + "pic_args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "pic_intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-003" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": { + "audit": 2 + }, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "2s8d0Ek7hZJ6VKc0yJPao3G2wc/rLBK4ASpGRUv07POYVW7qBIiNU8fnr0ANpcHnB27QHQCxwne3DLVldYOaCw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "4woqZ+lfFr8PqUIbknx8DitIOYTKlnF7iwcJylN0DWsAi2h6tyZOjTtyrWSzHdTSHFW83hRyCk2WMbWbzG0aCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + }, + { + "codes": [ + "calls_exceed_terms" + ], + "index": 2, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT02", + "title": "the third audit: TRACE allows each call, the parties agreed to two audits" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "7dbf89b0b480f6dacf3e1074340a64d6b62bb522559f104dd7481704e1c04796", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "7XQEoN5WP1oeBTlA3aQqqMzIXiGEr7N1R6lqioZDGSVdzBHaGqwH04N69RlAY08dhPO2IHc3h/mhq5tf2L4bCQ==" + } + ], + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "iQiXa2j3cTxQ_cx4Kcos2fFSD-fwbQt8oYPPqeYBjrLu_aNJq60J3P5BTxfH2p_ntkTWaHb0zlHlOBAvQH6RDw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "466de17289d87979f12ce81900b1999411ec35498e6f053552b0716b2b9830bf", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:06706ded4551e893719bc9a196ad248626f7384f8c1c15e75c9dfe010ee1a304", + "executed_at": 1787244857, + "pic_args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "pic_intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "schema": "musubi-trace-act-v0", + "seq": 3, + "signatures": [ + { + "role": "contractor", + "sig_b64": "yfPflLgoR/79U0nDr7pxvtyQFW02Zvzw6pJFGFXxeD7WZ0i1tJPCBJ+LR91eI12bMaL51H2eBKSWJGz7GDJfBA==" + } + ], + "tool_call_digest": "sha256:a6a72567e11099f22e93982c2cd864ea72359604295de6225f805a3bab0aa49e", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-003", + "authorized_at": 1787244827, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:06706ded4551e893719bc9a196ad248626f7384f8c1c15e75c9dfe010ee1a304", + "expires_at": 1787245427, + "pic": { + "args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a6a72567e11099f22e93982c2cd864ea72359604295de6225f805a3bab0aa49e", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "bhsSNi96OA5jXw41IQYaeTZ3E-VAEVAJfuhXFDP_AUk6ONLoLnsryvybmeMGiLFg-DEFH_SITCIhjQVWqU47CA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 3" + }, + "pic_args_digest": "sha256:8cd7cefd234f484824035192b72109701082bdf97ca52b5b61ed7c40f7bb0f4c", + "pic_intent_digest": "sha256:cf847f974ca7b97df94e23e62019ece2ad7792812f966a34116a128428c24ec1", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-003" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "2bd53fe5e8042a7522d5aea5837b278d30be7d897e3a96a59bbda5138d4a732c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:5e00fe83a501dfed70d529f0043df0a8051cf856a5e6f81188ff8ece61996532", + "executed_at": 1787244867, + "pic_args_digest": "sha256:18fff04d774795063f1c36d37ef06134ebc00a029a487787425b3edfddf4c172", + "pic_intent_digest": "sha256:0f3f8820cb7c769fcee6885f2e902f50a52d28c400ad5b9223ef900c91550a6f", + "schema": "musubi-trace-act-v0", + "seq": 4, + "signatures": [ + { + "role": "contractor", + "sig_b64": "OodQnsCe/fzVmtU70CYWPjrTxZl3jy9K0mU83BWuadQbdkBXQTSr8bPfMxw6v4XRA5h0gyN39K5KGYAmvPs8Bg==" + } + ], + "tool_call_digest": "sha256:ee5d0899793eee21c75a714c8343dd6f469b3814036eb03474a70007377d7c27", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-004", + "authorized_at": 1787244837, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:5e00fe83a501dfed70d529f0043df0a8051cf856a5e6f81188ff8ece61996532", + "expires_at": 1787245437, + "pic": { + "args_digest": "sha256:18fff04d774795063f1c36d37ef06134ebc00a029a487787425b3edfddf4c172", + "intent_digest": "sha256:0f3f8820cb7c769fcee6885f2e902f50a52d28c400ad5b9223ef900c91550a6f", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:ee5d0899793eee21c75a714c8343dd6f469b3814036eb03474a70007377d7c27", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "YWg0qCcGR0VYVZ-1JEFqlt0QhHVVoupTSYN4QGwsZc5BnfgFpcSsYYoMoFXAB4SGCCsXy6QIawQ9JGDsEV7FBw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 4" + }, + "pic_args_digest": "sha256:18fff04d774795063f1c36d37ef06134ebc00a029a487787425b3edfddf4c172", + "pic_intent_digest": "sha256:0f3f8820cb7c769fcee6885f2e902f50a52d28c400ad5b9223ef900c91550a6f", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-004" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": 2, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "Q65MoxDFEVoBoRKBryUMNHDfCrhacTi5nP3E6N4YIs6QRyBnYXv5mgcczvyyOJVKGSiVF/kAo6UFb/aTgpsMCQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "rcCrRBwvNyFwdj7BJPmi6flk6buweqCYcvBqW2RI6W7v+6onlBo1Pi+wtlT7sSdng3sAqzlgkGzVfm27PkgwAQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + }, + { + "codes": [ + "calls_exceed_terms" + ], + "index": 2, + "status": "outside_terms" + }, + { + "codes": [ + "calls_exceed_terms" + ], + "index": 3, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT03", + "title": "the total: two calls agreed, four made, the third and the fourth are over" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "808ca075ab929fe045b4facc2b47206637db5688c03af0623ca78ce10be69efc", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "qYlzld+RTv/6kPP5eNBezFFiKspsc9pebkVCl8LcFVUYPQ/nUWpV3duXCtVnuNy1LcJgcTb4BuT2U7vg6RClBw==" + } + ], + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit", + "estimate.compare" + ] + }, + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "zLflYDTH0uje8yEdsjZJ7nDie-6j61bUIul7KvME0NCHRDmHV-BfyiSVR-qddj5OUlEfpjmxUoUZR66KMFRxCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "prohibited_action" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT04", + "title": "the bridge scope includes compare and TRACE allows it; the contract prohibits compare" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "0012a963e79ea46ffcfba477b8dfd0c116fcd950be290ea053f05de77b68e726", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "ncc5aFcFQNFdNTTyieRO0oKN9ppOq9/V/lH9fycXrbci3HQI8Gr+8rl3QGrNmN9hGyjKQwGZmwoISAuBpUkUDg==" + } + ], + "tool_call_digest": "sha256:c8a435cf8921be359ba74545bb314e734d2adc88f9e000abf84733fc5ae8cae9", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.export" + ] + }, + "tool_call_digest": "sha256:c8a435cf8921be359ba74545bb314e734d2adc88f9e000abf84733fc5ae8cae9", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "udgNLlcBp-g8W6ywsmSOJk9U0d-cF9Wj8lpwiv_U6Dh3AIRPmitgfC5o0oJIASp7cqdoosUCjp7u5umOIULaAQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.export" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "action_not_granted" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT05", + "title": "a tool the terms map to an action the grant never authorized" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "b40e2ce06d630824219e8bd31677f0e578a84d2302fc536c15b15d0afdeb1e14", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "9kNe1xTOK+Z5fJUf7/Y1xfjywLKYOwotLNpZd6Csu4qdrt7GwvPrONu4OjPjRJjgv00RErjMjGuTjn9EQuGCAA==" + } + ], + "tool_call_digest": "sha256:004625deadda2d08f3767ba638b0b1e6312f9a12005d3ac6f8060d6b372a7588", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.delete" + ] + }, + "tool_call_digest": "sha256:004625deadda2d08f3767ba638b0b1e6312f9a12005d3ac6f8060d6b372a7588", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "K1A5mMmol-jhtC_1Y24WqfZa8tzTvOXAhyfwSmBFRDf00gH9tbGXsMuXe2OPy92B0HLFqcNTTukoTMLDVomgCg" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.delete" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "tool_not_in_terms" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT06", + "title": "a tool the terms do not name at all" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "387f472ea50d24d5e4c5282a90919c6c004e9c7c0e69aec729567d9daeb951f5", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "N58PAoFsqmx/jenCmtD/z8xDrLVl2bf0euaV/V4FeTNDEPQvLioWjr1T7xTcuCWRHt5Jmw4rX+bf7PPl0Y1UDg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "08h68aXgIeMkmDKFI69RbVGg-VfL63gZKJb5pwp2CO8o4gJtn4zbycAffmEmYKU4vU9apMV3kQr6doq84FkPBA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "v3q0wEdDtte328EXVENDOE3JBJ_s0azIKFpGa_5IuXg" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "authorizer_not_agreed", + "executed_without_valid_authorization" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT07", + "title": "TRACE verifies the bridge under the key the relying party supplied; the principal never agreed to it" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "25f23f0cca63bc16345af4221f54dd49d953da30570da9c934a0e2033f09a558", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "zQHqWIAJPwFF1kw8qNLcVk9tf56vrdz0C59e1jta6JvqzPvnzlh/bTgAg/S2Wi9aQoESp49Ok5MR0CuSyUCNBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "deny", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "cFHHq_tOZGwN6jCPy2mIMVJ2mKthR-HP4o_n0cVPPl0TblPsDnVzg-FBeaS5K9H80lBHyCoQDjjJPREm_sp5BA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "authorization_denied", + "executed_without_valid_authorization" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT08", + "title": "the signed decision is deny and the contractor executed the call anyway" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "52071cd9d13c7454ba8d391ab7aff8b5fff1a9b6f2c63eaa29d09add0518277c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "GzVppWU5QeD6ccOzoitMHanH9QMrKAKKjB4FrrQm7t82v1IR9fF6pw6hYdila4R5ZY6BE6OQMG7YEwy4bSsXBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787244827, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "nYwvDCIHrLGfkjCiHVMpNKDi7aS_KXLJ04nVinjyA8BE1CNsHr3NtkJmrL9toHxN1dpz8taky8BczJVPzkMYDQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "authorization_invalid", + "executed_without_valid_authorization" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT09", + "title": "the contractor states it executed after the authorization expired" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "3d020b81b78a1eb1c07f4d1b242c6bd715d341f29939f672700db023e5113291", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "jj29HNnopZ5LpSYUCn0jwfMBz3aM1jSNBSdfIUA/czh+Q61MyST5MlLOkPPIGF6FINyufkNtcDsAiepGQAZ3CQ==" + } + ], + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:e91c15a4ea9f501ec56e91edacaacfe81fb17f787e52397488fb90af450b805d", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "O0njEJzbfRhPgzyOizgKXvUBGnm4QfLmaxJoxUI29LtEEGCWThdmiRhm0X_dPQfUnt_s8PouOnocwOKao9oVCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "authorization_mismatch", + "executed_without_valid_authorization" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT10", + "title": "the authorization names one tool call, the contractor executed another" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "O6bs7F4Ny7yPN_w-gbwFNT_X74FrcAmHvRR4SpGkuRtOm19U89GH1v-Jd6w1ppnNtULKs63mJTCjT5z5dLl1DQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "evidence_not_as_signed" + ], + "index": 0, + "status": "undetermined" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT11", + "title": "the bundle carries another bridge than the one the act names: anyone can do that, so undetermined" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "08ed6856a64e29ed8fc5062398ccd1bd1e020d2ad4176c700b2d98d4f8d2a73b", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "70B0HNvj5oQSECt8V9Ssh5eSIph8TC6+hjj8vSzUEdJ6/8sjSGSS0RANAv7y7ZsBp/GZ+E3hphsTk0M1vo34Bg==" + } + ], + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-SHARED", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "IRnJA2ttCJgSD9eYt7mMPPt-dogpXrQR8u2UQdyos5AYx_8QcITE1RnTqU5IXRY-TytnpK0SCoMKf56PghV8DA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "59432ae87abb7716ebaed69bd88bae6e5384ae39429dd1dcac82a3402bd769b1", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "hcEdrjc7fBfqlXPUGp2Z0pn/5t6gIYab8DQlyw/t6WiD8QzgmdP5VDdfVvAvVuYdOGtYqcuzmD2EqypDW6J3Cg==" + } + ], + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-SHARED", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "dNs6xDhmgRfLT6NmhSNJnvr7i1SiuLeEiHH0A_uUC9X5apdh-F_rqcJN6cAYEz3uNTHp_0NHdB4XrxDARx4WDA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "authorization_reused" + ], + "index": 1, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT12", + "title": "one authorization carried two calls" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "c395050202b64c13808c53a990db624d675b6a84c6dc72c6761a18ef19de0e50", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "hcriPh4ZR60NoxjRRQzprvch7vNwpuwOZmmHeNmP9BFPEOjubrQNeF48tJhSUAUXoEnb9Bcri7SS+andyoyqBA==" + } + ], + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "O6bs7F4Ny7yPN_w-gbwFNT_X74FrcAmHvRR4SpGkuRtOm19U89GH1v-Jd6w1ppnNtULKs63mJTCjT5z5dLl1DQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": 1, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "BR9J5lYB12346FjISCeoTf61lnLkajE8UFTDmONPbSSJW0Tf5nkmlWHeVzaK2eSaKhZekY+QuDyOA1b5lryMAw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "QVrLrqDYGAdSOMwqHH/X5D5NbTrP3J2WxkkN/CagdBoc9D3M0PLitjYoKSMJEhZ3uOfaAqUNkHzRas39gXC4Ag==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "act_not_signed_by_contractor" + ], + "index": 1, + "status": "not_attributed" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT13", + "title": "an act signed by someone other than the contractor is reported and not counted against the total" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": 1, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "BR9J5lYB12346FjISCeoTf61lnLkajE8UFTDmONPbSSJW0Tf5nkmlWHeVzaK2eSaKhZekY+QuDyOA1b5lryMAw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "QVrLrqDYGAdSOMwqHH/X5D5NbTrP3J2WxkkN/CagdBoc9D3M0PLitjYoKSMJEhZ3uOfaAqUNkHzRas39gXC4Ag==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "same_act_again" + ], + "index": 1, + "status": "duplicate" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT14", + "title": "the same act bytes presented twice count once" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "b80f10de85d1175cef64acc4807f56d30c9cb31aa5c3eaa4c31105257677bd4d", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1789923726, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "ANoauLMkU9mtO9CEwIYpMmif8zxIbEJvIm4rG0Sj+SYGAzLxFbrm5pZHuYgsae2wBOWtBOc0JQ29m11LhwWjAQ==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "dded4f16f5724d5788ffd38502ffda6b778cc0380802617c0be1a0390cbe09ec", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1789923696, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1789924296, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "v1pIk01v1-69iCUIcUQqsueXOwQ2WP3gae0Tzjv9miRJDmSinIYUcPHLoXRQBMk24wTAkFxtvW00KIYYTTnFCw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "status": "none", + "timestamp": 1789923666, + "verifier": "https://bernstein.run/trace/verifier" + }, + "build_provenance": { + "digest": "sha256:b77a81d8049d1bfbfbd322124eb8ceb3c6a05f91336e874a388cef7059cef1e0", + "provenance_uri": "https://github.com/sipyourdrink-ltd/bernstein/releases", + "slsa_level": 0 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kid": "install-0000000000000000", + "kty": "OKP", + "x": "ff3LjX7m5f7vj3YD5NS_LqtEzEa_wkD5ZnNPBpSD3o8" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1789923666, + "model": { + "model_id": "claude-haiku-4-5-20251001", + "provider": "anthropic" + }, + "policy": { + "bundle_hash": "sha256:a8bc7643a9c822bf7a3a410fff1f1be4bce47f2ea99ec22c444d85c9ec67094f", + "enforcement_mode": "enforce" + }, + "runtime": { + "measurement": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "platform": "software-only" + }, + "signature": "8WWLHXTC0fe_63KDjaiihseCL6dSm2MasRDurSyV_6o2x1lgiwzNAU3Vrnt0f7Ho9E0rfajNF22gedCI6yNoCg", + "subject": "spiffe://bernstein.run/run/20260920-165918/exec/backend-99365805" + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "appraisal_not_agreed", + "model_not_agreed", + "platform_not_agreed", + "policy_not_agreed", + "producer_not_agreed", + "slsa_below_terms", + "subject_not_agreed" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT15", + "title": "Bernstein 3.20.0's real record under terms that agreed on the summit runtime" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "b80f10de85d1175cef64acc4807f56d30c9cb31aa5c3eaa4c31105257677bd4d", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1789923726, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "ANoauLMkU9mtO9CEwIYpMmif8zxIbEJvIm4rG0Sj+SYGAzLxFbrm5pZHuYgsae2wBOWtBOc0JQ29m11LhwWjAQ==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "dded4f16f5724d5788ffd38502ffda6b778cc0380802617c0be1a0390cbe09ec", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1789923696, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1789924296, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "v1pIk01v1-69iCUIcUQqsueXOwQ2WP3gae0Tzjv9miRJDmSinIYUcPHLoXRQBMk24wTAkFxtvW00KIYYTTnFCw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "status": "none", + "timestamp": 1789923666, + "verifier": "https://bernstein.run/trace/verifier" + }, + "build_provenance": { + "digest": "sha256:b77a81d8049d1bfbfbd322124eb8ceb3c6a05f91336e874a388cef7059cef1e0", + "provenance_uri": "https://github.com/sipyourdrink-ltd/bernstein/releases", + "slsa_level": 0 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kid": "install-0000000000000000", + "kty": "OKP", + "x": "ff3LjX7m5f7vj3YD5NS_LqtEzEa_wkD5ZnNPBpSD3o8" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1789923666, + "model": { + "model_id": "claude-haiku-4-5-20251001", + "provider": "anthropic" + }, + "policy": { + "bundle_hash": "sha256:a8bc7643a9c822bf7a3a410fff1f1be4bce47f2ea99ec22c444d85c9ec67094f", + "enforcement_mode": "enforce" + }, + "runtime": { + "measurement": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "platform": "software-only" + }, + "signature": "8WWLHXTC0fe_63KDjaiihseCL6dSm2MasRDurSyV_6o2x1lgiwzNAU3Vrnt0f7Ho9E0rfajNF22gedCI6yNoCg", + "subject": "spiffe://bernstein.run/run/20260920-165918/exec/backend-99365805" + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "none" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 0, + "models": [ + { + "model_id": "claude-haiku-4-5-20251001", + "provider": "anthropic" + } + ], + "platforms": [ + "software-only" + ], + "policy_bundle_hashes": [ + "sha256:a8bc7643a9c822bf7a3a410fff1f1be4bce47f2ea99ec22c444d85c9ec67094f" + ], + "producers": [ + "eXGZiAH6OxMgiUzqcTgubU9pYlSIP3-u6WdQ0w2nxL8" + ], + "subjects": [ + "spiffe://bernstein.run/run/20260920-165918/exec/backend-99365805" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "wLJrzERIosWNysW9D6iyXXvbpDHJQbd/uiP1xaeSyBTtr700cg0RElM46ItEYLZH9SDqDz2067z35r1n/cUtCw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "FZau9l0gn8Gyh9Go1ETntdgwuCMk3ROa93ayoNElAYIDxF8c528fkDJZW9mcbZLXo0l0EH0WbyYqfnpQ+L8eCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT16", + "title": "the same real record under terms that agreed on exactly that software-only runtime" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "HXdATPkKJj9UuDzB9iz0ougz16T3dLkzHCsEDrBuAaK1xNL5jJ2JEJAfQKhHJMKI1BtzjV0yK2H04gzti040Cg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": null, + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": null + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "runtime_evidence_not_named" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT17", + "title": "the parties agreed on a runtime and the contractor signed an act that names no Trust Record" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "X0vPwTHYb6G8XzINLVqmQH8dr3tLxHScNjKIqeHJEv314avCqA+DIAULl88ySNer4hHX4k5vd7pgw2UgXxCUBw==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "a105d7bec402523427514e69a2f2de309e062c134f9d0fa5a1223afee5723379", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v4", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "trace_refused" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT18", + "title": "the summit record with its model changed after signing" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "/tsDu5dsU27Z7vNafq6x/mHmOlv06mhEXcvDLjn2KUO84eBKQP3ZdcYjra5EZxfVnTUdA5PDFpnNarH77gSgCg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "0000000000000000000000000000000000000000000000000000000000000000", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "runtime_evidence_missing" + ], + "index": 0, + "status": "undetermined" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT19", + "title": "the act names one Trust Record, the bundle carries another (the real summit record)" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "e595d342eeb0ef3711dbdc69753154a4aaee1740b47a4696f019da61acfd487b", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787417567, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "/rMapuUQjRFkyaREa8RT+/chCyGyhrJqGSCIlM16QLbIOvNjHq/DvvVeLe2OEUKzdddT1ZYGBbkmrRG9N52uCA==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787417537, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787418137, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "SsrjKdMVuHMV-gqVaTJLRcVHgTMq9wrhlUYFIgClUNZPAVA-SNydtnpK2LAldKlLFkNnvumoxf0DstyIWc8NDQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "trace_stale_at_act" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT20", + "title": "the call ran two days after the record it names was issued" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "internal" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "YLSMMjpeY30JvD0sO7e4qsIpJwDPItVk34TeWO/rPkB8s9w5VO2HqLzL4q7sAjtwLXRHCEh0+4tr9sA0CVXIAA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "gFv969gbatVZ05sQlWDFXGR03BBMbjbLbSz2F6RTBQlMZJmc800yj+ugs7EjsSyL4+RjjYReuiS9zaUx9PepBw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "data_class_not_agreed" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT21", + "title": "the parties agreed on internal data, the record states confidential" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "57443d9ea25f6a3c408f508cf90d95108af527401a74828ba9ea413d895927f0", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244857, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "4+L/Wn0DlNl3IfGgCMsM+h4SR+tL0axdLBHojNtCBgFd8Q8PVTuseIlvQSyeo3rojnA7UZ2GF+aEPk/4Ac8aCg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "24bcbc9655319b2ce687599e88e715eab51766722eac42d0a125e615596b4f19", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244827, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245427, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8CdxUs6tQjfm1-tYLxbelhx0lbp7zYs_mh-q6m9BO1xddguujx1EvrpwS5CUjt_mMRrW-ODxnVkqIFcgTANmCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "__74YjnEsUa7BLGJL5V0ROTluYyK7qrMKv4J49k_u_c" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244827, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "monitor" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "TQQiuMWcPzgmD1hDiKjyzXVqFXh-qm8t8NM6a8T0G__yk__kt-Dhmzv7hWhSc0F3nA2iRCVS4G5SWcXFbu1_CA", + "subject": "spiffe://contractor.example/agent/estimator" + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "iCGLyvUIVi-7MwrdWEmnwispRe1OsQMmDhbqW1GrSwU" + ], + "subjects": [ + "spiffe://contractor.example/agent/estimator" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "sAUp6AFVfcBUiI8wOtE58EzrfKoYE904hToSc/mulktTMgS2Dg64KyJPCxL8R43aiMtcQZkhSpRwe6v4AGh8BQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "qeD1MD+MWbQ10QmOYg7cjpHx4tkR8o8PdRcGl/eq/cgpL82WU8YTU1aQxHYgUmZIIgBQgtWAPDaQvD/4ucHvCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "enforcement_not_agreed" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT22", + "title": "a record agentrust-trace signs here states monitor where the parties agreed on enforce" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "OOuhoDwKdj+xNox3C3PzUuuWHtEoQVKjFjKSKvlfCFByWKJQi1JYkizbUNOiE6SmrVsIN7castgu7JjFVSS1BA==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "dded4f16f5724d5788ffd38502ffda6b778cc0380802617c0be1a0390cbe09ec", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "status": "none", + "timestamp": 1789923666, + "verifier": "https://bernstein.run/trace/verifier" + }, + "build_provenance": { + "digest": "sha256:b77a81d8049d1bfbfbd322124eb8ceb3c6a05f91336e874a388cef7059cef1e0", + "provenance_uri": "https://github.com/sipyourdrink-ltd/bernstein/releases", + "slsa_level": 0 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kid": "install-0000000000000000", + "kty": "OKP", + "x": "ff3LjX7m5f7vj3YD5NS_LqtEzEa_wkD5ZnNPBpSD3o8" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1789923666, + "model": { + "model_id": "claude-haiku-4-5-20251001", + "provider": "anthropic" + }, + "policy": { + "bundle_hash": "sha256:a8bc7643a9c822bf7a3a410fff1f1be4bce47f2ea99ec22c444d85c9ec67094f", + "enforcement_mode": "enforce" + }, + "runtime": { + "measurement": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "platform": "software-only" + }, + "signature": "8WWLHXTC0fe_63KDjaiihseCL6dSm2MasRDurSyV_6o2x1lgiwzNAU3Vrnt0f7Ho9E0rfajNF22gedCI6yNoCg", + "subject": "spiffe://bernstein.run/run/20260920-165918/exec/backend-99365805" + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT23", + "title": "runtime not in the terms: a Trust Record is carried and not read" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "b72ee2df7b8e703b45c649564288c63e7815da4f4ce4d67d50a36da6e7036561", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "lW0vmbVf8/b6SjSbSrWUkyiBLMx+rGLUPm6FxK96CBf3TagaWdjQhnUgdjrxfo4Ty3KMWhlOi5l62WbRkswrCQ==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "successor_observation_digest": "sha256:abababababababababababababababababababababababababababababababab", + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": true + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "tPGqEx2fumlNg3lNqsZpstsp8GikBWEcnWstwryAeoxgRLQ0V1pQ60VKm-GioPV61y-W4k4M8x2pslCmhlHJCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "authorization_mismatch", + "executed_without_valid_authorization" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT24", + "title": "transcript required by the authorization and not supplied" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "terms_one_sided" + ], + "verdict": "refused" + }, + "id": "TT25", + "title": "terms signed by the principal only" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "1111111111111111111111111111111111111111111111111111111111111111", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "wVfmfzgFwbGR7biObgkiKItY9L0V/bfuvbP8Wi25SKxfcLSyxdi31oQdfNz0osueBNm/MiYWiMTiAGGjREBEDw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "nFm3JL62TBbhaLY2jVI3hvqv+VZNNpcGtY4PEHwEnUomcYlfOJYMxPUMjq6ZJjvOr/puhLr362vPdZE96sxHAw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "terms_for_other_contract" + ], + "verdict": "refused" + }, + "id": "TT26", + "title": "terms naming another contract" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d32d9f98b94811a096e4cfc5b4626e908e2b23c084a715a1d632bf0bb409425b", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "dtJMaAGDF3+LOaseBYX+dZZFVl6lRt2TKYGaqay4IDML9MNeBlbiizEOKy72AAt/N2mSu34GUxi5BOY47jEEBQ==" + } + ], + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.compare" + ] + }, + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "vf-2qmi_j9sO26DaUOHrGvf46tIX6QYB73OogPrS3IRPYbNwufzMmGyENEZKOjXY9Mja_LY2rfaaAturxl8MAA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "contract:bad_signature", + "contract:one_sided" + ], + "verdict": "refused" + }, + "id": "TT27", + "title": "the contract changed after both signed it (compare no longer prohibited)" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "note": "trust me", + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "9JkC22/mH72eN/w3YNTaiWyOe0MzO9vVkWEAr06HiWzYkRwzSgecTKaVdGIc0tvWAo40Q4CWvMvn5tjlf0qpDg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "Uw22YLJosYEoFbVOdgQ69xSiVFk0rQLh4lSxVspv7ewkhoHillsPtu9NGJSxVd3twjXm88yOhkcn+FsIDcniCw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "terms_malformed:members" + ], + "verdict": "refused" + }, + "id": "TT28", + "title": "terms with a member no reader checks" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 0, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "c395050202b64c13808c53a990db624d675b6a84c6dc72c6761a18ef19de0e50", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "C8nAKJiX5Nnnz369MGPXKWY4Ee2aR8cCmX6oLapUNJN3LuCE0+yxeH2HrZ6lUmJfHGPGDP8q3xwaXNYuds0BAw==" + } + ], + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "O6bs7F4Ny7yPN_w-gbwFNT_X74FrcAmHvRR4SpGkuRtOm19U89GH1v-Jd6w1ppnNtULKs63mJTCjT5z5dLl1DQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "act_malformed" + ], + "index": 0, + "status": "not_attributed" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT29", + "title": "an act altered after signing so it is no longer well formed: nobody's act, reported and not counted" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": null + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "runtime_evidence_missing" + ], + "index": 0, + "status": "undetermined" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT30", + "title": "the act names the summit record and the bundle does not carry it" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "158238315b9bc3ecf4ddf1111d08decfe4f393735e64d4eaaf8974032902c05b", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2.0, + "signatures": [ + { + "role": "contractor", + "sig_b64": "LS0oAEyF/QaIVz7bouFknnILjJm2CiNduQJQKyteuMedUNoGdsxXGXwpCAgfZeAX3PrKVJKjABcoSWfQFln2Aw==" + } + ], + "tool_call_digest": "sha256:c68cda4a5c29b5aa6adc7d401ebb5d139b1093615485d9480f9e55023e6130ce", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.compare" + ] + }, + "tool_call_digest": "sha256:c68cda4a5c29b5aa6adc7d401ebb5d139b1093615485d9480f9e55023e6130ce", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "CfWbv-mXTJADjstNZxoCuGnYyvBukvpw8PQcUWXASut_wBrafVMkCkde-43fgLCIHUWEz8PHXjbq5xBSkQszDQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "act_malformed", + "signed_by_contractor" + ], + "index": 1, + "status": "unreadable" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT31", + "title": "the contractor signs a malformed act for a prohibited call: it cannot drop out of sight as within" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "ad6e156c44bb0ed549feca1379220b595ef0f1af63dd24bc207e590aa20236bb", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "3AouVULvzfZzdeIv5q/JHj+LqOAa9HL0Rp4bc056SAvWJzN0hAU2QSWRQKEzAi0WI0fc2lynXy8gzlo5InfYDA==" + } + ], + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-X", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.compare" + ] + }, + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "llCVmsuReyoh55h24AFUAkvOaTuTL4ljkeNfKKAryYBb2i0edGUErQKLBASWr_LpjnewAxN1Vk6sPECZ20drCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "seq_conflict" + ], + "index": 0, + "status": "outside_terms" + }, + { + "codes": [ + "prohibited_action", + "seq_conflict" + ], + "index": 1, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT32", + "title": "two different acts the contractor signed with one seq, a report and a prohibited compare" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "ad6e156c44bb0ed549feca1379220b595ef0f1af63dd24bc207e590aa20236bb", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "3AouVULvzfZzdeIv5q/JHj+LqOAa9HL0Rp4bc056SAvWJzN0hAU2QSWRQKEzAi0WI0fc2lynXy8gzlo5InfYDA==" + } + ], + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-X", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.compare" + ] + }, + "tool_call_digest": "sha256:fd01cbf7f65336de70d98328998c24687d7325b9b66bf0f8d99facdc42ac665e", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "llCVmsuReyoh55h24AFUAkvOaTuTL4ljkeNfKKAryYBb2i0edGUErQKLBASWr_LpjnewAxN1Vk6sPECZ20drCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "prohibited_action", + "seq_conflict" + ], + "index": 0, + "status": "outside_terms" + }, + { + "codes": [ + "seq_conflict" + ], + "index": 1, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT33", + "title": "the same two acts in the other order: the verdict does not depend on who orders the bundle" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "57443d9ea25f6a3c408f508cf90d95108af527401a74828ba9ea413d895927f0", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244857, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vPkd3jzz0HTDTFmv/c7nuln2CS235EMzKeBD9th3sHSdKiQ/pP7SWATkQehfngKRb33hnHmfrxBCV47Ng1BeCg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "57c5c3d02638172f5d0ce26ad7e3b954c5b9269f9a8658a3e5397f2b8507a69b", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244827, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245427, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8CdxUs6tQjfm1-tYLxbelhx0lbp7zYs_mh-q6m9BO1xddguujx1EvrpwS5CUjt_mMRrW-ODxnVkqIFcgTANmCQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "__74YjnEsUa7BLGJL5V0ROTluYyK7qrMKv4J49k_u_c" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244827, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "DmUA7YzrLUYlUbfcOoLoQWSpuatcx-PpLi6g6ARkGEyVUVicHSH6HynQtfnOBt-LSKAN-ITLpCXqwsQSGFyhBw", + "subject": "spiffe://someone-else.example/agent/x" + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "iCGLyvUIVi-7MwrdWEmnwispRe1OsQMmDhbqW1GrSwU" + ], + "subjects": [ + "spiffe://contractor.example/agent/estimator" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "sAUp6AFVfcBUiI8wOtE58EzrfKoYE904hToSc/mulktTMgS2Dg64KyJPCxL8R43aiMtcQZkhSpRwe6v4AGh8BQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "qeD1MD+MWbQ10QmOYg7cjpHx4tkR8o8PdRcGl/eq/cgpL82WU8YTU1aQxHYgUmZIIgBQgtWAPDaQvD/4ucHvCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "subject_not_agreed" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT34", + "title": "a genuine record from an agreed producer, about another agent" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "changed by whoever assembled the bundle" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "evidence_not_as_signed" + ], + "index": 0, + "status": "undetermined" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT35", + "title": "a third party changes the declaration: undetermined, the contractor is not blamed" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "v3q0wEdDtte328EXVENDOE3JBJ_s0azIKFpGa_5IuXg" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "authorizer_key_not_supplied" + ], + "index": 0, + "status": "undetermined" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT36", + "title": "the agreed authorizer's key is not supplied: undetermined, not authorizer_not_agreed" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ", + "z": "\ud800" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "act_malformed", + "signed_by_contractor" + ], + "index": 0, + "status": "unreadable" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT37", + "title": "an unsigned bridge carrying a lone surrogate: a verdict, not a crash" + }, + { + "bundle": { + "acts": [], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + "xxx", + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "contract:unreadable" + ], + "verdict": "refused" + }, + "id": "TT38", + "title": "a contract whose party is not an object: a verdict, not a crash" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "158238315b9bc3ecf4ddf1111d08decfe4f393735e64d4eaaf8974032902c05b", + "contract_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "rslj/OJUt/JfYs+lXjQRq9OjSfoof3LkklSgs9TUDb2niFRi8BX4xi7Vnz7xgKS621lLmXy+WtRUyXj/jeXSBg==" + } + ], + "tool_call_digest": "sha256:c68cda4a5c29b5aa6adc7d401ebb5d139b1093615485d9480f9e55023e6130ce", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.compare" + ] + }, + "tool_call_digest": "sha256:c68cda4a5c29b5aa6adc7d401ebb5d139b1093615485d9480f9e55023e6130ce", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "CfWbv-mXTJADjstNZxoCuGnYyvBukvpw8PQcUWXASut_wBrafVMkCkde-43fgLCIHUWEz8PHXjbq5xBSkQszDQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "contractor_act_for_other_contract" + ], + "index": 1, + "status": "other_contract" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT39", + "title": "the contractor signs a prohibited call's act under another contract: not judged here, and not within" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "bc9fa9182a03fd727d23e1ee67500575c2dee9c6b7d7ee987be8bf02081e0d2a", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "TUe+IK7RKJk9Xz8WvmyH2BGKAaUM4larlsMteqlfkC6NCVWyP7rrLtJ5AaVwn9ryH0XjIze5WpD9yyxWZmzOBw==" + } + ], + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "feJHRSxH-8P3WJ4vSdKW4pHLGFonPXZssMrwZXtyAKKwTeG_EPfg2Q0jk5LFeb-j6JXDcxQISImfAdRWcrv_Dg" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": { + "estimate.audit": 1 + }, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "Nz77vXQnKG1dfT8CqV0xB7Z7nqPw8Kd+sEFiWEDm0g8dhGFYzLcTiUg7TQvBKPBP2lrR9LpLCGn6ivARs676DA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "ngmntBdhzk1tNgv1R8g3ycSi5lRH3eh+l5sjzzZt0B1YIGoECCVhzWTEvDz0rwMMvy/pasWKc7BcwGyvchzkDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "terms_malformed:max_calls_unknown_action" + ], + "verdict": "refused" + }, + "id": "TT40", + "title": "a cap on a name no tool maps to would never apply: refused" + }, + { + "bundle": { + "acts": [], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT41", + "title": "no acts at all: nothing was shown to be within the terms" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "72f3c4d453b974b1a5e7ce1f573c3a3f56d5f3d5066b6f53e3751953df5e129d", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "exhreb5J1j0cPK9/1WsTH+qvmxwHMl6lsEsn9b/cESnFnjbEm63sB19W5ltpOzJS46aii2OBVennb1M6KvU5Cw==" + } + ], + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-2", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "KOGqLnmIA4vGYAjh3RBp_uMKP3WNNwzqxFNP-gsnxf8cmSQtLxIomqKOH8Z2TdS2dDSDy0OvPgtv-0VR00NSBA" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-2", + "kty": "OKP", + "x": "UyfVZwDtsMI4zgov2IbYjBurFWD9ZIgMOSuKKw3p1FY" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms", + "mWbxTN2-DoZ2lCw7BW5YvxBMo-w2DmGAK_TSS3WoSPA" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "qiq/rYh5kudm7F/WgPj0toJ8T1Fep4DLZtNIqrgoU8fC/augwh1iFWG8PBdmIQm+JuZFyS3T2fHRK9xIxCIcCw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "1mQdHkdg5jpJweD1Ui9Q9H8xWEaeAqvWCpU9FiASihncI2I4xiWISmKBcnTXkHJuvhpzJLNTP+yITdnlqAFyCA==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT42", + "title": "two agreed authorizers each number their first authorization A-001: not a reuse" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "bc9fa9182a03fd727d23e1ee67500575c2dee9c6b7d7ee987be8bf02081e0d2a", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "TUe+IK7RKJk9Xz8WvmyH2BGKAaUM4larlsMteqlfkC6NCVWyP7rrLtJ5AaVwn9ryH0XjIze5WpD9yyxWZmzOBw==" + } + ], + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:06beb82e95d68042490651a26c3ecdfa2a6438ebbd2f87973fe5bc0f91cfee01", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "feJHRSxH-8P3WJ4vSdKW4pHLGFonPXZssMrwZXtyAKKwTeG_EPfg2Q0jk5LFeb-j6JXDcxQISImfAdRWcrv_Dg" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "7dbf89b0b480f6dacf3e1074340a64d6b62bb522559f104dd7481704e1c04796", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "7XQEoN5WP1oeBTlA3aQqqMzIXiGEr7N1R6lqioZDGSVdzBHaGqwH04N69RlAY08dhPO2IHc3h/mhq5tf2L4bCQ==" + } + ], + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "iQiXa2j3cTxQ_cx4Kcos2fFSD-fwbQt8oYPPqeYBjrLu_aNJq60J3P5BTxfH2p_ntkTWaHb0zlHlOBAvQH6RDw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.compare" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": { + "audit": 1 + }, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "Zkhog8f5sZ5FJGHvGIIGVM+seWqONqD1Fk/oPl8XzyetDdSZlhiTUKBGjNVs+RrMkYdZF18kLFqLNI+6xolYAQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "o0G8xKdQQ5/YkVWMwt3qcrl9rhK1L+ieefcL77VaMhNOpIBuprhZ4XNqGlb362tTjNE8ss9TI/gbCPF6hqntAA==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "evidence_not_as_signed" + ], + "index": 1, + "status": "undetermined" + } + ], + "refusals": [], + "verdict": "undetermined" + }, + "id": "TT43", + "title": "a third party swaps the tool call for a prohibited one: undetermined, and the audit count is not moved" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "7dbf89b0b480f6dacf3e1074340a64d6b62bb522559f104dd7481704e1c04796", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787244847, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "7XQEoN5WP1oeBTlA3aQqqMzIXiGEr7N1R6lqioZDGSVdzBHaGqwH04N69RlAY08dhPO2IHc3h/mhq5tf2L4bCQ==" + } + ], + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787244817.0, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787245417.0, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:a4ca98013f455a0a263450cb516620e9ee07091262fad30d3ef101f40f511c8b", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "iQiXa2j3cTxQ_cx4Kcos2fFSD-fwbQt8oYPPqeYBjrLu_aNJq60J3P5BTxfH2p_ntkTWaHb0zlHlOBAvQH6RDw" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.audit" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT44", + "title": "whoever assembles the bundle writes the bridge's integer times as equal floats: same digest, same verdict" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2.0 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT45", + "title": "the summit record's slsa_level written as 2.0: the producer signed the same bytes, the verdict is the same" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "not what the act names" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "same_act_again" + ], + "index": 0, + "status": "duplicate" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT46", + "title": "the same act twice, the first copy with other evidence: the copy that matches the act is the one read" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "7d118b1424173320d4db01ecf34b7363bf3bad78c25557498a165962f1b01113", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "R6tp4DaOx3gnxnSIEvWMgy1wvwvnVzRpWhM4/COugezGUu2zab1j60yOxiGiso8zOcrFcjq/vqb3oPhL7Yn/Aw==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d7", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [ + { + "action": "report", + "requires": "principal_approval" + } + ], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "dAb+kGbx9BfVPiiUYGZN3GwVViserBzkYBqkMHMl1sPIsLN3PD7eQyQTib5arQHZcm+mlP0VsYS8OdbdbKsXDQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "uFDuMlJdvrfEanFoDKQNwRiWNGXjiaAV9Fmasr8FRzfe/eYUGrhk+Ghn/6PEkgwP5HdloTiViCn5cvNEzwVDCQ==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "7d118b1424173320d4db01ecf34b7363bf3bad78c25557498a165962f1b01113", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "CX/+uOb5gsMPzcogN1tS+fuBAxLLv401c/7UD6Io7ttvYgT9XjeMgwVjinrYbWTOo6JFNGLhBhUtwHsb8KxpDA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "0THh80wjgLFAasvVNIfv/0OH/dJdHXFXHa4k5Rz5a8MzSeZFAi/B7+xWDBJUINEpgCBiHbQjM7hVjOsZdwlBBg==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "grant_clause_not_judged:conditional" + ], + "verdict": "refused" + }, + "id": "TT47", + "title": "a grant with a conditional clause this profile does not judge: refused, not judged as if it were absent" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "f0175c6454dcedeae10ab51e3e3dfe959a0c859b596c9f16775dbbb9a9b6f119", + "contract_sha256": "4edf53a00bffc8fc67cdea15ba360b9052c4071ab169b340cdbd48ea8a06211b", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "phYHRwGget+aVuRasdzTZaHpgO972ivCt3RQMvgbrWbi1dGENYZJxmMxYAaZjkmkXG+yDdJzdNAGjhEtQrAnAQ==" + } + ], + "tool_call_digest": "sha256:816acd3a27f8129c6cc3c9fecda10e1707604e40c4814eb17e91f34df83b1dec", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:816acd3a27f8129c6cc3c9fecda10e1707604e40c4814eb17e91f34df83b1dec", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "jRPZfk4Gg-e3_g1bxEGzAvF7urxxANjhECnNqbgVAwuBQYY2k9svFPayWmJbpuivhaYGbGHxear6mNMOmYDRAQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1000000, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d8", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "limits": { + "report": { + "max_amount": 1, + "unit": "JPY" + } + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "admission": "required_before_execution", + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "nNs+yvQ4AF2fTXLjYA/9c6PeUpweQj73p9zDhrR+LbVo6tBlmH+rzFcxRNr2/j3WZg4rCz1BVAI7g4QUKq0gBg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "EOl7LdytOylZ71Lbc7YBXmNBQYSAJlDqneTHfaVRlz+VeH9Iyb4WKBovB1nW53g7pKQSwa76DXJOX9fFyoDbCQ==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "4edf53a00bffc8fc67cdea15ba360b9052c4071ab169b340cdbd48ea8a06211b", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "9NtbqeuRhP1K5xRAQt4n+KDto0VpeGYMh0UBWTHQPfwTRXBag621fuX54dwhZG0LlDhvzMZmnkNc0NP49qybBw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "mDm3RHkzxDdHmWimHRQNKt5t3E9vyCWN49pUmx7vDpYIck0+L8fPahaUtUECfp14XkMaxy21NkIndRgTGbP4CQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "contract_clause_not_judged:requirements.admission", + "grant_clause_not_judged:limits" + ], + "verdict": "refused" + }, + "id": "TT48", + "title": "a grant with amount limits: refused here, settle judges amounts" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + {} + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "act_malformed" + ], + "index": 1, + "status": "not_attributed" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT49", + "title": "a junk item nobody signed is reported and does not move the verdict" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + }, + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "bundle_malformed:authorizer_jwks" + ], + "verdict": "refused" + }, + "id": "TT50", + "title": "more authorizer keys than a bundle may carry" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "status": "none", + "timestamp": 1789923666, + "verifier": "https://bernstein.run/trace/verifier" + }, + "build_provenance": { + "digest": "sha256:b77a81d8049d1bfbfbd322124eb8ceb3c6a05f91336e874a388cef7059cef1e0", + "provenance_uri": "https://github.com/sipyourdrink-ltd/bernstein/releases", + "slsa_level": 0 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kid": "install-0000000000000000", + "kty": "OKP", + "x": "ff3LjX7m5f7vj3YD5NS_LqtEzEa_wkD5ZnNPBpSD3o8" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1789923666, + "model": { + "model_id": "claude-haiku-4-5-20251001", + "provider": "anthropic" + }, + "policy": { + "bundle_hash": "sha256:a8bc7643a9c822bf7a3a410fff1f1be4bce47f2ea99ec22c444d85c9ec67094f", + "enforcement_mode": "enforce" + }, + "runtime": { + "measurement": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "platform": "software-only" + }, + "signature": "8WWLHXTC0fe_63KDjaiihseCL6dSm2MasRDurSyV_6o2x1lgiwzNAU3Vrnt0f7Ho9E0rfajNF22gedCI6yNoCg", + "subject": "spiffe://bernstein.run/run/20260920-165918/exec/backend-99365805" + } + }, + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "vXmttM64IRRRZtsSF4JOupuoyW/TvtzHXtA+KFi13391eWC9RyjhvH5SsZFSq6Sqv7evL97MwM1o94lblnlRBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": { + "appraisal_status": [ + "affirming" + ], + "data_classes": [ + "confidential" + ], + "enforcement_mode": "enforce", + "max_age_seconds": null, + "min_slsa_level": 2, + "models": [ + { + "model_id": "summarizer-v3", + "provider": "example" + } + ], + "platforms": [ + "azure-cvm-sev-snp" + ], + "policy_bundle_hashes": [ + "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3" + ], + "producers": [ + "4PXGQSwQS0Wt33I0I0g7weN1lEupfL8rQRKMEzs1OFU" + ], + "subjects": [ + "spiffe://example.org/agent/planner" + ] + }, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "ALxq/Yc1xMeLEOWXYJ+66s/lIEVZRkbiCb3j56vIY5RlzqgsXOItmPQ2SdABthhNUIfTvJDlXNOgz2oSSTeBCg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "xtehiIFtiMY9G/9WR6Arl84AvEzuQFe4tiSqTcSt71BkgdvjGhmJec3MBRssafK4yRW+C7A2CAVsf13v7y5gDw==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "same_act_again" + ], + "index": 0, + "status": "duplicate" + }, + { + "codes": [], + "index": 1, + "status": "within_terms" + } + ], + "refusals": [], + "verdict": "within_terms" + }, + "id": "TT51", + "title": "the same act twice, the first copy carrying another Trust Record: the copy whose record matches is read" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "1e6fb020ad103c0ef747293a9517dc35fd2a30fca515e59d93bb75b41095fcfd", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "y6NdHusxjmXlmptAWOdx+l0BtnZSy03zP0W8DggPge+w8amnCvIPfXcMCdKHKFxwFXoXzAyJgmmTuVxFIE0fAw==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d9", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": { + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "settlement_url": null + }, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "7YTtR51CRmz/AB65sisZcyhsMndh6utfOOo/zy3Kr6aaeQPe0ywSXWWJblqTpgi14Vf74cxIb0CrqFjX5AuKCQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "c5diSarR+XJrpwyZSEoIis/SBHDY8NrZnua8BEMdxjxN6rr9lBuaIkFlLsGpL/8ZxEFZqf4PCu1grkhOuTKkCw==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "1e6fb020ad103c0ef747293a9517dc35fd2a30fca515e59d93bb75b41095fcfd", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "VN2fLhkrRvHmsdBc3jttLMKNN0GoBmIn+6FUhOHaR9lbNAdEzfIG8aUZXvufWwsHDMGhaj/U1M0ZbKuTE4r4CA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "vw8yyc0xQFyZrwsYvMYSmNODLAr16bZLfRFJsjgNHnWgYzc4HqfMaV7SVjpLsSeCvgK87Y/GogKYMm1XJlKLBg==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "contract_clause_not_judged:parent_contract" + ], + "verdict": "refused" + }, + "id": "TT52", + "title": "a child contract whose parent is not supplied: refused, a parent was never checked" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "d8b5773396d7796f9256a855eb6c07160aad881dda258ee9fd8f50ca4bf1948f", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "kA1pvjNTf+3fqO1SGR3reZZaE3Wzs+p1pSfYgoK2xXE8FEHrJQ53vbaqpV2x1s0fsIyw/YcP/KWc6XNW/jBYBg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5da", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "nenrin_required", + "recovery": "tsugi_required" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "O1dVV/4RzXZdyEMzuHPSOMEyudKBiVSefFcFNvIKNwccFmogOO1NGt2KIo/AyP8nUJqrd8awvvCT6giPA4O+Aw==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "tHjHLac8oVDSumKNOQENmoMEuTdWpcAZmu3ah1z3A5Qv0Rjyii6DMhesjCsmRmqK7K6sou7ok1GHYFKl0KcMAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "d8b5773396d7796f9256a855eb6c07160aad881dda258ee9fd8f50ca4bf1948f", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "eg8HRUdDy5Pk8ZE9/f4Xqg2pnoqQitGrv/Zxtzho0Ouq+WzanYDvs5X+0x9VvuOGHGIScoyqAxo9P4K8cG77Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "b8mvtN8ehbRgwUctKG0GFDpZwjt32BHBe5pelv9qguHtZUmO/Q9UPydQ+kzDEguhU1B9gQUpXH1legc8Bw7BBg==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [], + "refusals": [ + "contract_clause_not_judged:requirements.evidence", + "contract_clause_not_judged:requirements.recovery" + ], + "verdict": "refused" + }, + "id": "TT53", + "title": "a contract requiring NENRIN evidence and TSUGI recovery: refused here, settle judges those" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "40ae5d8c7df96377386025ab412671d006331c043f135003501b7804f75347bc", + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1785538800, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "Vj6lmNJQjPpPBKtywQMGJzJMDX3v5rYpycrhpPPZ+kzW7U43d4zrrc8hCv+sAA/rE8LdQHhI9dUzEEE6GeINAg==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1785538770, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1785539370, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "tYwZpvGUMFxLYNP3flpK7ZmIpRw6WpNmJaCVl-4ZGRmuGW3uyL1vYxmMBEIhlioHmkXW6fzSI97BD26EdYlnBg" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5d6", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": null, + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "IajoXvja+Z0QaJp23L8q+htsu9YI4epHrDNOBDctnA9A7hEr4tdFCZJu0t/MCg2CNyZ/jB9J65NmMTJMz1j5BA==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "MhGzt9S5NF/Iwg1C7J38vhR0QEgskv4xAaF0NKfbo+f/+Gyrv/c8exAosNhfYLEfP45Rl/Lwn97+WaP5J3DRAA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "bfe57cf50a258c71ab99b7bb9609890328d052597fca2bc438cc4460a7100545", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "NHQD3/jol4EaFOzvODIZ7P3zXGF6bGQic6Sn5uR1gj72+2aRLpZfVWggE/1LrsMOHvo2Pc5lD/L/GSV9cx/8Bg==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "9/P/t6iNcWYr77ucilvTV/8r1kyoMtLBML57cSVYQCnzohOI5lASM/pKPyx7lifDW2Bv1+ue/cedY/iuzEzdCQ==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [ + "executed_before_agreed_at" + ], + "index": 0, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT54", + "title": "the contractor states the call ran an hour before the contract was agreed" + }, + { + "bundle": { + "acts": [ + { + "act": { + "bridge_sha256": "d7d36b3d93bfc13354e58e22f9209773d0e3d98fdc9da7e8be6786a00756e57c", + "contract_sha256": "aecfcaf89c47233100adc8ca9bdcb197a544a574c0278fb7558b5dc18879b92a", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "executed_at": 1787244837, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "schema": "musubi-trace-act-v0", + "seq": 1, + "signatures": [ + { + "role": "contractor", + "sig_b64": "no5O0kdECZsWwfRlxgmxlpuKFDg/g7YNbzz0SHWJVRY0NED/4IQV54t9jNiqeTyUYQ3vbjslnQVD6uQUvgepCw==" + } + ], + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-001", + "authorized_at": 1787244807, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:daf1135df18b46edcdbc7f468c07fbdad95ab3a186dc04e5cd313f604f4cd68f", + "expires_at": 1787245407, + "pic": { + "args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:b78365b5877e8ab17c9278263edf39d5ec0720f599e55d34f807d802ceed0ece", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "8Pys_DclCwk9KE3kfIwzsLVvarSU_1W1PvA64n7C2daU6fSm8HKh18_Kub69fTif4xovU-zmtv4yVPnXc2u2BQ" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 1" + }, + "pic_args_digest": "sha256:2060f845fcb5ee04058a66c6b36647ad9f9543eb4fa373a252458f17d3afd416", + "pic_intent_digest": "sha256:f57b8243beb8e45cdfee1f48b697f89b62f8989f61a1e821af680fe63edd1e3b", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-001" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + }, + { + "act": { + "bridge_sha256": "ed5b42f5fa0fe53f0da5b439d6f6c88450ff16d1c6db78150937aef38172d0d0", + "contract_sha256": "aecfcaf89c47233100adc8ca9bdcb197a544a574c0278fb7558b5dc18879b92a", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "executed_at": 1787417627, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "schema": "musubi-trace-act-v0", + "seq": 2, + "signatures": [ + { + "role": "contractor", + "sig_b64": "K4hZsHai20ibKVhYjOwqU1GbeKhe0NHRdkyUWtLeS5/AtVB5aOsm573jrP0riroP9FaZK4S2lNrYkSpCbOTaAw==" + } + ], + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "trace_sha256": "1046f475f6232a178b58d300c603ef5f0c46d7a6386540a0a2522edd8536d3b5", + "transcript_digest": null + }, + "bridge": { + "authorization": { + "authorization_id": "A-002", + "authorized_at": 1787417597, + "authorizer": "principal.example", + "authorizer_key_id": "auth-1", + "decision": "allow", + "declaration_digest": "sha256:30bba1cbbea86a915da9b1e75a0f570773d20c85d2d5e347b8e43305b81e14fd", + "expires_at": 1787418197, + "pic": { + "args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "profile": "PIC-CJSON/1.0" + }, + "scope": { + "impacts": [ + "read" + ], + "tools": [ + "estimate.report", + "estimate.audit" + ] + }, + "tool_call_digest": "sha256:71f86e1dde19f2f84bfe04128db5ae5a24cb02f4ad61b5d8ec77fac24cf0bdf4", + "transcript_required": false + }, + "profile": "tag:agentrust-io.com,2026:pic-trace-bridge-v1", + "signature": "LWVYU5lCh2Ahe69M_EopaZAamHX49YKAE2lxrQLiUknMflCZVbVqwwiBZMJ8KEgrzHbpZUBecIWbCrpyrkWlCg" + }, + "declaration": { + "impact": "read", + "summary": "estimate call 2" + }, + "pic_args_digest": "sha256:f4f259892bb93e2fd369f55892ac8842ff658ca6b2f162c71916acaa14b73d29", + "pic_intent_digest": "sha256:9b34c5f0dc9a044811df91b0293175837dcb5e1476b632c57929f526c90f5c41", + "tool_call": { + "arguments": { + "amount": 1, + "estimate_id": "E-002" + }, + "name": "estimate.report" + }, + "transcript": null, + "trust_record": { + "appraisal": { + "policy_ref": "https://registry.example/policy/tpm2-appraisal-v1", + "status": "affirming", + "timestamp": 1787244767, + "verifier": "https://verifier.example/tpm" + }, + "build_provenance": { + "builder": "https://github.com/example-org/agent-runtime/.github/workflows/release.yml", + "digest": "sha256:8aacb0f60ce141de3b7f341dd7a488e8281c7d8df9a4c1936a77ec67d4e2a827", + "provenance_uri": "https://transparency.example/entries/demo", + "slsa_level": 2 + }, + "cnf": { + "jwk": { + "crv": "Ed25519", + "kty": "OKP", + "x": "MlMDcC9FD2XTwcHx_cMV7aTqq8sfXlTcyFNSDkqsgSE" + } + }, + "data_class": "confidential", + "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", + "iat": 1787244767, + "model": { + "model_id": "summarizer-v3", + "provider": "example", + "version": "20260601" + }, + "policy": { + "bundle_hash": "sha256:f4c26445ea31e0c9209efe7c065cc398f1100b77bbb9a6124a12a72439da6bb3", + "enforcement_mode": "enforce", + "policy_uri": "https://registry.example/policy/cui-summarize-v2.1", + "version": "cui-summarize-v2.1" + }, + "runtime": { + "firmware_version": "15787368493747273732", + "measurement": "sha384:5b0ce64ad1c1f6375dbda5f760b98526ca1bcf91b8195091afc28e7b024251d68fe32e05af34048d6607678cd23283ff", + "platform": "azure-cvm-sev-snp" + }, + "signature": "o-gOt6MwCWuizcQ8uHy89Fl4G9e8E_9VXFd0tA0UbMJv9vlQZRStnwJX5b3KVfydXGFMAQAz1hBtzJrrGoVYDQ", + "subject": "spiffe://example.org/agent/planner", + "tool_transcript": { + "call_count": 4, + "hash": "sha256:553494dbca57c42653cc782ef423977ca64ed1917f3423f31e79674f296aacc0" + } + } + } + ], + "authorizer_jwks": [ + { + "crv": "Ed25519", + "kid": "auth-1", + "kty": "OKP", + "x": "poe-rrh6hoWZ4eGJO1N-fyyQh80Q4hPSVn98mI59_6o" + } + ], + "contract": { + "agreed_at": "2026-08-01T00:00:00Z", + "bond": null, + "contract_id": "7e5c0a1d2b3c4d5e6f708192a3b4c5db", + "does_not_establish": [ + "that anyone enforced any of this at runtime; the terms are proved against the records afterwards", + "that anyone judges liability or fault; the verdict is a function anyone recomputes", + "that a deviation was impossible, only that performing one is a provable deviation", + "that this is a legal contract or determines legal responsibility", + "that the parties exist: every key here is a test key derived from a fixed label" + ], + "establishes": [ + "that both parties signed these grant bytes" + ], + "expiry": "2026-08-21T00:00:00Z", + "grant": { + "authorized_actions": [ + "report", + "audit" + ], + "conditional": [], + "delegation": { + "allowed": [] + }, + "privacy": "public_record", + "prohibited_actions": [ + "compare" + ], + "revocation": { + "effective_at": "anchor" + }, + "witnesses": [] + }, + "liability_boundary": [], + "lower_bound": null, + "nonce": "0f1e2d3c4b5a69788796a5b4c3d2e1f0", + "parent_contract": null, + "parties": [ + { + "domain": "principal.example", + "key_url": "https://principal.example/keys/principal.json", + "public_key_ed25519_b64": "94aNCMoQF1JS0yNeP1qSGdLXTM0uBzQZ0t1wXh5f1es=", + "role": "principal" + }, + { + "domain": "contractor.example", + "key_url": "https://contractor.example/keys/contractor.json", + "public_key_ed25519_b64": "53IP/ipCvhoDymOMlcdUdrl0RcaQQrlUSktlb3jWtz8=", + "role": "contractor" + } + ], + "requirements": { + "evidence": "n/a", + "recovery": "n/a" + }, + "schema": "a2a-contract-v0", + "selection_provenance": null, + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "pLzonsxMXgOVfepFr8/1dpOviULLqjLEkSArEu+lITYBh0W8ZIHcqRfjLrRauBgSzu9i3PjiqrN94Jy9csk5DQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "JtFeNjgNkUZFHOn26Qp4fDlZT9tH4WgzHVTPhJJnGVfVjLuKSWOTKqVEwhiYZaVkY+7OJb3CjI3Stu9Kto6TDA==" + } + ], + "task": { + "payload_digest": "f3969bf9b6b6cf58ea26be89d86018fe059c61836abf490e2919ff6f2f8000fe", + "purpose": "trace-terms-v0 test vectors: estimate report and audit calls" + } + }, + "terms": { + "authorizers": [ + "WrgcdZJ5K3WMUgB5Uku_hesbEMLpno6waWaXe8d40Ms" + ], + "contract_sha256": "aecfcaf89c47233100adc8ca9bdcb197a544a574c0278fb7558b5dc18879b92a", + "max_calls": {}, + "max_calls_total": null, + "runtime": null, + "schema": "musubi-trace-terms-v0", + "signatures": [ + { + "alg": "ed25519", + "domain": "principal.example", + "signature": "14kuH6pBmXSw+YpqgDsHt269A5EHw5kjSJjx3p2ZvUuAaGMPl6AcvAneR/Lr8Pan7+VVz3MddhWP+NowFx7PDQ==" + }, + { + "alg": "ed25519", + "domain": "contractor.example", + "signature": "GG18HN2/xVbBZEPAZc2nuLR4SnqcIJOKOVl/rUgGaCtXHTYSzRIw/pTAiwTJF6Yh3Fk5HAuF/BQFWu5kf33UBg==" + } + ], + "tools": { + "estimate.audit": "audit", + "estimate.compare": "compare", + "estimate.export": "export", + "estimate.report": "report" + } + } + }, + "expect": { + "acts": [ + { + "codes": [], + "index": 0, + "status": "within_terms" + }, + { + "codes": [ + "executed_after_expiry" + ], + "index": 1, + "status": "outside_terms" + } + ], + "refusals": [], + "verdict": "outside_terms" + }, + "id": "TT55", + "title": "a call the contractor states ran after the contract expired" + } + ] +} diff --git a/integrations/litzki-systems-sovp/README.md b/integrations/litzki-systems-sovp/README.md index 933b28c3..8e1843b5 100644 --- a/integrations/litzki-systems-sovp/README.md +++ b/integrations/litzki-systems-sovp/README.md @@ -68,8 +68,9 @@ passes **8/8**. These are exact tested versions, not a claim that every later release is compatible. The AgenTrust maintainers reproduced release 0.1.1 independently on 2026-09-23 -in a fresh Windows Python 3.12 environment. Release 0.2.0 has not yet been -reproduced by a maintainer. +in a fresh Windows Python 3.12 environment, and release 0.2.0 on 2026-10-12 in +the same setup, including an independent recomputation of the `references` +digest (review on #295). `trace-tests verify` checks the signature against the key the record carries in `cnf.jwk`, so a record signed with any key passes Level 0. A relying party diff --git a/integrations/nobulex/README.md b/integrations/nobulex/README.md deleted file mode 100644 index 5c2a9968..00000000 --- a/integrations/nobulex/README.md +++ /dev/null @@ -1,41 +0,0 @@ -# Nobulex integration with TRACE (external execution evidence) - -Nobulex is a Python SDK that emits Ed25519-signed receipts for agent actions. Each receipt is JCS-canonical (RFC 8785) and carries `action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` as a content-derived identifier. - -This positions Nobulex receipts as external execution evidence in the sense described in trace-spec #34: signed assertions from a non-gateway authority, bound to a specific call by `action_ref`, independently verifiable against the issuer public key. - -**What this integration does:** generates verifiable per-action receipts from Python agents that can be attached as `external_execution_evidence` on cMCP audit entries. - -**What it does not claim:** Nobulex receipts are not TRACE Trust Records. They are per-action signed assertions that a verifier can optionally check alongside a Trust Record, as described in trace-spec #34. - -## Run it - -```bash -pip install nobulex -``` - -```python -from nobulex import Agent - -agent = Agent("my-agent") -receipt = agent.act("tool_call", scope="resource:read") - -assert receipt.verify() # Ed25519 signature over JCS-canonical fields -print(receipt.action_ref) # SHA-256(JCS({agent_id, action_type, scope, timestamp_ms})) -print(receipt.signature) # hex-encoded Ed25519 signature -print(receipt.signer_public_key) # hex-encoded Ed25519 public key -``` - -## What is verified - -Running the above produces a receipt where: -- `receipt.verify()` returns `True` — signature is valid over the canonical field set -- `receipt.action_ref` is a 64-character hex string — SHA-256 over JCS-canonical JSON -- The receipt can be independently verified by any party holding `signer_public_key` - -## Links - -- PyPI: https://pypi.org/project/nobulex/ -- npm: https://www.npmjs.com/package/@nobulex/core -- Repo: https://github.com/arian-gogani/nobulex -- Demo: https://nobulex.com/demo diff --git a/integrations/nobulex/integration.yaml b/integrations/nobulex/integration.yaml deleted file mode 100644 index 723cd6b6..00000000 --- a/integrations/nobulex/integration.yaml +++ /dev/null @@ -1,21 +0,0 @@ -name: Nobulex -vendor: Nobulex -integrates_with: - - trace -description: >- - Emits Ed25519-signed JCS-canonical action receipts; each carries - action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms})) - usable as TRACE external execution evidence (trace-spec #34). -maintainer: - github: arian-gogani - email: nobulex.dev@gmail.com -repository: https://github.com/arian-gogani/nobulex -homepage: https://nobulex.com -license: MIT -tier: verified -marketplace: - category: Evidence & receipts - mark: NX - keywords: [receipts, Ed25519, evidence] -trace_roles: - - external-evidence-source diff --git a/integrations/parmana-server/integration.yaml b/integrations/parmana-server/integration.yaml index 6e4ab262..86bb8fee 100644 --- a/integrations/parmana-server/integration.yaml +++ b/integrations/parmana-server/integration.yaml @@ -7,7 +7,7 @@ description: >- authorized-intent and approval-outcome references; checks their signatures offline. maintainer: github: pavancharak -repository: https://github.com/pavancharak/parmana +repository: https://github.com/pavancharak/parmana-core homepage: https://docs.parmanasystems.com license: Apache-2.0 tier: verified diff --git a/integrations/parmana-server/parmana_evidence.py b/integrations/parmana-server/parmana_evidence.py index bb2b6db9..28318713 100644 --- a/integrations/parmana-server/parmana_evidence.py +++ b/integrations/parmana-server/parmana_evidence.py @@ -68,8 +68,15 @@ def _public_key(pem: str) -> Ed25519PublicKey: def _verify(pem: str, signature_b64: str, message: bytes) -> bool: - key = _public_key(pem) - signature = base64.b64decode(signature_b64) + if not isinstance(signature_b64, str) or not signature_b64: + return False + try: + key = _public_key(pem) + signature = base64.b64decode(signature_b64.encode("ascii"), validate=True) + except (ValueError, TypeError): + return False + if len(signature) != 64 or base64.b64encode(signature).decode("ascii") != signature_b64: + return False try: key.verify(signature, message) return True @@ -91,14 +98,17 @@ def verify_trust_record(record: dict[str, Any], keys: dict[str, str]) -> Check: def verify_refusal_record(record: dict[str, Any], keys: dict[str, str]) -> Check: """A Refusal Record: its hash, and its signature under `keys`.""" + if not isinstance(record, dict) or not isinstance(keys, dict): + return Check(False, ["record and keys must be objects"]) errors: list[str] = [] message = canonical_serialize({k: record[k] for k in _REFUSAL_FIELDS if k in record}) if hashlib.sha256(message).hexdigest() != record.get("refusalRecordHash"): errors.append("refusalRecordHash does not match the record") - signature = record.get("signature") or {} + raw_sig = record.get("signature") + signature = raw_sig if isinstance(raw_sig, dict) else {} if signature.get("algorithm") != "ed25519": errors.append(f"unsupported algorithm: {signature.get('algorithm')}") - elif signature.get("keyId") not in keys: + elif not isinstance(signature.get("keyId"), str) or signature.get("keyId") not in keys: errors.append(f"no public key for keyId {signature.get('keyId')!r}") elif not _verify(keys[signature["keyId"]], signature.get("value", ""), message): errors.append("signature does not verify") @@ -107,13 +117,20 @@ def verify_refusal_record(record: dict[str, Any], keys: dict[str, str]) -> Check def verify_approval(approval: dict[str, Any], keys: dict[str, str]) -> Check: """A signed human approval: its signature over the payload.""" - signature = approval.get("signature") or {} + if not isinstance(approval, dict) or not isinstance(keys, dict): + return Check(False, ["approval and keys must be objects"]) + raw_sig = approval.get("signature") + signature = raw_sig if isinstance(raw_sig, dict) else {} + raw_payload = approval.get("payload") + payload = raw_payload if isinstance(raw_payload, dict) else {} + raw_issuer = payload.get("issuer") + issuer = raw_issuer if isinstance(raw_issuer, dict) else {} key_id = signature.get("keyId") - if key_id != approval.get("payload", {}).get("issuer", {}).get("keyId"): + if not isinstance(key_id, str) or key_id != issuer.get("keyId"): return Check(False, ["signature keyId differs from the payload's issuer keyId"]) if key_id not in keys: return Check(False, [f"no public key for keyId {key_id!r}"]) - message = canonical_serialize(approval["payload"]) + message = canonical_serialize(payload) if not _verify(keys[key_id], signature.get("value", ""), message): return Check(False, ["signature does not verify"]) return Check(True) diff --git a/integrations/parmana-server/tests/test_parmana_evidence.py b/integrations/parmana-server/tests/test_parmana_evidence.py index 10acf890..ae3be0b1 100644 --- a/integrations/parmana-server/tests/test_parmana_evidence.py +++ b/integrations/parmana-server/tests/test_parmana_evidence.py @@ -130,3 +130,25 @@ def test_the_connector_result_is_labelled_a_mock(): assert cases["refusal"]["connectorInvocations"] == 0 assert cases["replay"]["connectorInvocations"] == 0 assert REPORT["totalConnectorInvocations"] == 1 + + +@pytest.mark.parametrize( + "mutator", + [ + lambda a: a["signature"].update({"value": "!!!" + a["signature"]["value"]}), + lambda a: a["signature"].update({"value": "not-valid-base64="}), + lambda a: a.update({"signature": "not-a-dict"}), + lambda a: a.update({"payload": None}), + lambda a: a["payload"].update({"issuer": "not-a-dict"}), + ], +) +def test_parmana_rejects_non_canonical_base64_and_non_dict_containers(mutator): + bad_app = copy.deepcopy(APPROVAL) + mutator(bad_app) + assert not pe.verify_approval(bad_app, APPROVER_KEYS).valid + + bad_ref = copy.deepcopy(REFUSALS["refusal"]) + bad_ref["signature"]["value"] = "!!!" + bad_ref["signature"]["value"] + assert not pe.verify_refusal_record(bad_ref, PARMANA_KEYS).valid + bad_ref["signature"] = ["not-a-dict"] + assert not pe.verify_refusal_record(bad_ref, PARMANA_KEYS).valid diff --git a/integrations/pic-standard-mcp-guard/README.md b/integrations/pic-standard-mcp-guard/README.md index 72ea6687..fbfe840b 100644 --- a/integrations/pic-standard-mcp-guard/README.md +++ b/integrations/pic-standard-mcp-guard/README.md @@ -56,6 +56,41 @@ fresh temporary sandbox, declared `impact: irreversible`) through `guard_mcp_too hook, observes that the tool actually ran, signs a Level 0 Trust Record, and self-verifies it before writing. All keys are deterministic Ed25519 TEST keys. +## Reproduce from the fixed lock + +This is the exact procedure for evaluating this integration. Runtime and test +dependencies are installed from the committed hash-locked requirements, and the +integration is then installed with `--no-deps`. + +From the repository root of a fresh clone, with Python 3.11 (CI also runs the +same lock on Python 3.12 and 3.13): + +```bash +python3 -m venv .venv +.venv/bin/python -m pip install --require-hashes -r requirements/pic-standard-mcp-guard-fixed.txt +.venv/bin/python -m pip check +.venv/bin/python -m pip install --no-deps -e integrations/pic-standard-mcp-guard +.venv/bin/python -m pip check +.venv/bin/python -m pytest integrations/pic-standard-mcp-guard/tests -q +.venv/bin/python integrations/pic-standard-mcp-guard/examples/emit_record.py --out trust-record.json +.venv/bin/trace-tests verify --record trust-record.json --level 0 +``` + +On Windows, create the environment with `py -3.11 -m venv .venv` and use +`.venv\Scripts\` in place of `.venv/bin/`. + +Expected: + +- both `pip check` runs report no broken requirements; +- pytest reports `157 passed`; +- `emit_record.py` prints + `wrote trust-record.json (status=record-emitted, pic_decision=allowed)`; +- `trace-tests verify` reports `Result: PASS (15 checks, 4 skipped)`. + +The fixed lock pins `pic-standard` 0.9.1, `agentrust-trace` 0.11.0, +`agentrust-trace-adapters` 0.2.0, and `agentrust-trace-tests` 0.6.2. +All four are released on PyPI. + ## What is verified - Missing, empty, or `None` `__pic_request_id` is rejected by the coordinator before diff --git a/integrations/pic-standard-mcp-guard/integration.yaml b/integrations/pic-standard-mcp-guard/integration.yaml index d266892b..28fb8a44 100644 --- a/integrations/pic-standard-mcp-guard/integration.yaml +++ b/integrations/pic-standard-mcp-guard/integration.yaml @@ -11,7 +11,7 @@ maintainer: repository: https://github.com/agentrust-io/integrations homepage: https://github.com/pic-standard/pic-standard license: Apache-2.0 -tier: community +tier: verified marketplace: display_name: PIC Standard MCP Guard category: Security & policy diff --git a/integrations/ramen-ai-cmcp/_receipt_verify.py b/integrations/ramen-ai-cmcp/_receipt_verify.py index 1180f1ab..3ba67a84 100644 --- a/integrations/ramen-ai-cmcp/_receipt_verify.py +++ b/integrations/ramen-ai-cmcp/_receipt_verify.py @@ -5,6 +5,7 @@ import base64 import hashlib import json +import re from cryptography.exceptions import InvalidSignature from cryptography.hazmat.primitives import serialization @@ -16,6 +17,20 @@ CONFORMANCE_PUBLIC_KEYS: dict[str, str] = { "ramen_pk_ephemeral_test": "MCowBQYDK2VwAyEACmDytPXlfjKUMgV5l4w31xHt/G5p30UsNm/AmOI9OaM=", } +_B64URL_RE = re.compile(r"[A-Za-z0-9_-]+") + + +def _unique_object(pairs: list[tuple[str, object]]) -> dict[str, object]: + out: dict[str, object] = {} + for k, v in pairs: + if k in out: + raise ValueError(f"duplicate JSON object key: {k!r}") + out[k] = v + return out + + +def _no_nonfinite_constant(token: str) -> object: + raise ValueError(f"non-finite JSON constant is not allowed: {token}") def verify_v5_receipt( @@ -40,9 +55,17 @@ def _verify( original_input: str, extra_keys: dict[str, str], ) -> tuple[bool, str | None]: - kid: str = receipt.get("kid", "") - signature_b64url: str = receipt.get("signature", "") - canonical_payload: str = receipt.get("canonical_payload", "") + if not isinstance(receipt, dict) or not isinstance(original_input, str): + return False, "receipt must be a dict and original_input must be a string" + kid = receipt.get("kid", "") + signature_b64url = receipt.get("signature", "") + canonical_payload = receipt.get("canonical_payload", "") + if ( + not isinstance(kid, str) + or not isinstance(signature_b64url, str) + or not isinstance(canonical_payload, str) + ): + return False, "kid, signature, and canonical_payload must be strings" key_registry = {**PRODUCTION_PUBLIC_KEYS, **extra_keys} if kid not in key_registry: @@ -51,13 +74,19 @@ def _verify( pub_key = _load_spki_key(key_registry[kid]) try: pub_key.verify(_b64url_decode(signature_b64url), canonical_payload.encode("utf-8")) - except InvalidSignature: + except (InvalidSignature, ValueError): return False, "Signature does not verify over canonical_payload" try: - payload = json.loads(canonical_payload) - except json.JSONDecodeError as exc: + payload = json.loads( + canonical_payload, + object_pairs_hook=_unique_object, + parse_constant=_no_nonfinite_constant, + ) + except (json.JSONDecodeError, ValueError) as exc: return False, f"canonical_payload is not valid JSON: {exc}" + if not isinstance(payload, dict): + return False, "canonical_payload must decode to a JSON object" if payload.get("schema_version") != "5.0": return False, ( @@ -79,8 +108,9 @@ def _load_spki_key(spki_b64: str) -> Ed25519PublicKey: def _b64url_decode(value: str) -> bytes: - padded = value.replace("-", "+").replace("_", "/") - padding = 4 - len(padded) % 4 - if padding != 4: - padded += "=" * padding - return base64.b64decode(padded) + if not isinstance(value, str) or not _B64URL_RE.fullmatch(value) or len(value) % 4 == 1: + raise ValueError("signature must be canonical unpadded base64url") + raw = base64.urlsafe_b64decode(value + "=" * (-len(value) % 4)) + if len(raw) != 64 or base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii") != value: + raise ValueError("signature must be canonical 64-byte base64url") + return raw diff --git a/integrations/ramen-ai-cmcp/tests/test_mapping.py b/integrations/ramen-ai-cmcp/tests/test_mapping.py index 5d4466a5..9a2d960f 100644 --- a/integrations/ramen-ai-cmcp/tests/test_mapping.py +++ b/integrations/ramen-ai-cmcp/tests/test_mapping.py @@ -132,6 +132,14 @@ def test_unknown_kid_fails(self): assert valid is False assert "Unknown kid" in (reason or "") + def test_non_canonical_base64url_signature_rejected(self): + from _receipt_verify import _b64url_decode + + for bad_sig in ("A" * 85 + "B", "A" * 86 + "==", "A+B/C" + "A" * 81): + with pytest.raises(ValueError): + _b64url_decode(bad_sig) + + class TestBuildTraceRecord: @pytest.fixture diff --git a/integrations/sentinel/requirements.lock.txt b/integrations/sentinel/requirements.lock.txt index 823aa49e..0a9eda16 100644 --- a/integrations/sentinel/requirements.lock.txt +++ b/integrations/sentinel/requirements.lock.txt @@ -15,9 +15,9 @@ anyio==4.15.1 \ # httpx # starlette # watchfiles -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx diff --git a/integrations/xchk-registry/tests/test_trust_record.py b/integrations/xchk-registry/tests/test_trust_record.py index 34942039..d5a16ebc 100644 --- a/integrations/xchk-registry/tests/test_trust_record.py +++ b/integrations/xchk-registry/tests/test_trust_record.py @@ -629,3 +629,23 @@ def test_a_key_file_that_does_not_decode_is_reported_by_error_class_only(tmp_pat assert x.main([str(EX / "01-trust-record.json"), "--jwk", str(p), "--now", str(AT_ISSUE)]) == 1 out = json.loads(capsys.readouterr().out) assert out["status"] == "no-key" and out["reason"] == "pinned key file: UnicodeDecodeError" + + +def test_is_ed25519_jwk_and_load_json_reject_private_params_non_canonical_b64_and_duplicate_keys( + tmp_path, +): + for param in ("d", "p", "q", "dp", "dq", "qi", "oth", "k"): + assert not x.is_ed25519_jwk({**JWK, param: "secret"}) + assert not x.is_ed25519_jwk({**JWK, "x": JWK["x"] + "="}) + assert not x.is_ed25519_jwk({**JWK, "x": "A" * 42 + "B"}) + for bad_now in (True, False, -1, 1.5, "100"): + with pytest.raises(ValueError): + x.Instant(bad_now) # type: ignore[arg-type] + dup = tmp_path / "dup.json" + dup.write_text('{"a": 1, "a": 2}', encoding="utf-8") + val, err = x.load_json(str(dup)) + assert val is None and err is not None + nan_f = tmp_path / "nan.json" + nan_f.write_text('{"a": NaN}', encoding="utf-8") + val, err = x.load_json(str(nan_f)) + assert val is None and err is not None diff --git a/integrations/xchk-registry/xchk_trace_record.py b/integrations/xchk-registry/xchk_trace_record.py index ea285995..72e60e66 100644 --- a/integrations/xchk-registry/xchk_trace_record.py +++ b/integrations/xchk-registry/xchk_trace_record.py @@ -35,6 +35,23 @@ # record older than the bound is reported `invalid` with the reason, and a historical record is re-verified at its # own time with --now, not by widening the bound to nothing. (18 Oct 2026, review of integrations#338.) MAX_AGE_SECONDS = 86400 +_PRIVATE_JWK_PARAMS = frozenset({"d", "p", "q", "dp", "dq", "qi", "oth", "k"}) + + +def _loads_strict(raw: str | bytes): + def _no_duplicate_keys(pairs): + out = {} + for k, v in pairs: + if k in out: + raise ValueError(f"duplicate JSON object key: {k!r}") + out[k] = v + return out + + def _no_nonfinite(token: str): + raise ValueError(f"non-finite JSON constant is not allowed: {token}") + + text = raw.decode("utf-8") if isinstance(raw, (bytes, bytearray)) else raw + return json.loads(text, object_pairs_hook=_no_duplicate_keys, parse_constant=_no_nonfinite) class Instant: @@ -47,8 +64,10 @@ class Instant: __slots__ = ("at", "overridden") def __init__(self, now: int | None = None): + if now is not None and (type(now) is not int or now < 0): + raise ValueError("now must be a non-negative integer Unix timestamp") self.overridden = now is not None - self.at = int(now) if self.overridden else int(time.time()) + self.at = now if self.overridden else int(time.time()) def fields(self) -> dict: return {"verified_at": self.at, "verified_at_overridden": self.overridden} @@ -93,15 +112,24 @@ def record_verifies(record: dict, jwk: dict, max_age_seconds: int = MAX_AGE_SECO def is_ed25519_jwk(jwk) -> bool: """An OKP/Ed25519 JWK with base64url key material of 32 bytes; nothing else is a key this tool verifies with.""" - if not isinstance(jwk, dict) or jwk.get("kty") != "OKP" or jwk.get("crv") != "Ed25519": + if ( + not isinstance(jwk, dict) + or _PRIVATE_JWK_PARAMS.intersection(jwk) + or jwk.get("kty") != "OKP" + or jwk.get("crv") != "Ed25519" + ): return False x = jwk.get("x") - if not isinstance(x, str) or not x: + if not isinstance(x, str) or not x or len(x) % 4 == 1: return False try: - return len(base64.urlsafe_b64decode(x + "=" * (-len(x) % 4))) == 32 + raw = base64.urlsafe_b64decode(x.encode("ascii") + b"=" * (-len(x) % 4)) except (ValueError, TypeError): return False + return ( + len(raw) == 32 + and base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=") == x + ) def key_from_published(doc, kid: str) -> dict | None: @@ -120,10 +148,10 @@ def key_from_published(doc, kid: str) -> dict | None: if not isinstance(material, str) or not material: return None try: - raw = base64.b64decode(material, validate=True) + raw = base64.b64decode(material.encode("ascii"), validate=True) except (ValueError, TypeError): return None - if len(raw) != 32: + if len(raw) != 32 or base64.b64encode(raw).decode("ascii") != material: return None return {"kty": "OKP", "crv": "Ed25519", "x": base64.urlsafe_b64encode(raw).decode("ascii").rstrip("="), "kid": kid} return None @@ -197,7 +225,7 @@ def published_key(origin: str, kid: str, timeout: float = 20.0) -> dict | None: raw = r.read(KEY_DOC_MAX_BYTES + 1) if len(raw) > KEY_DOC_MAX_BYTES: return None - doc = json.loads(raw) + doc = _loads_strict(raw) except Exception: # noqa: BLE001 return None try: @@ -289,7 +317,7 @@ def verify_with_key_source(record: dict, pinned: dict | None, fetch=published_ke if refusal: return {"status": "no-key", "key_source": None, "kid": kid, "revocation": None, **bounds, "reason": refusal} if pinned is not None: - if isinstance(pinned, dict) and "d" in pinned: + if isinstance(pinned, dict) and _PRIVATE_JWK_PARAMS.intersection(pinned): # 19 Oct 2026: a trust anchor is a PUBLIC key; a file carrying the private member is refused, and no part of it # is echoed (the reason is fixed text) return {"status": "no-key", "key_source": None, "kid": kid, "revocation": None, **bounds, "reason": "the pinned key file holds a private key (member d); pin the public key only"} @@ -339,7 +367,7 @@ def main(argv: list[str] | None = None) -> int: print(json.dumps(out, indent=2)) return 1 jwk = j.get("trace_signer_jwk", j) if isinstance(j, dict) else j # a bare JWK, or {trace_signer_jwk: ...}; the shape is checked next - if not is_ed25519_jwk(jwk) and not (isinstance(jwk, dict) and "d" in jwk): + if not is_ed25519_jwk(jwk) and not (isinstance(jwk, dict) and _PRIVATE_JWK_PARAMS.intersection(jwk)): jwk = {"not": "a jwk"} # verify_with_key_source says so, with the reason; never None (that would mean "no pin given") out = verify_with_key_source(record, jwk, max_age_seconds=a.max_age, now=instant, registry=a.registry) out["approval_outcome_references"] = [ @@ -354,8 +382,8 @@ def load_json(path: str, detail: bool = True) -> tuple: """(value, None) or (None, why): a local file that is not JSON is reported, not raised. detail=False reports the error class only: a decode error's message can quote bytes of the file, and a key file's bytes are not echoed.""" try: - return json.loads(Path(path).read_text(encoding="utf-8")), None - except (OSError, ValueError, UnicodeDecodeError) as e: + return _loads_strict(Path(path).read_text(encoding="utf-8")), None + except (OSError, ValueError, UnicodeDecodeError, RecursionError) as e: return None, f"{type(e).__name__}: {str(e)[:120]}" if detail else type(e).__name__ diff --git a/marketplace/catalog.json b/marketplace/catalog.json index a4b55158..5d8a4936 100644 --- a/marketplace/catalog.json +++ b/marketplace/catalog.json @@ -665,25 +665,28 @@ ] }, { - "name": "Nobulex", - "package_name": "Nobulex", - "vendor": "Nobulex", - "description": "Emits Ed25519-signed JCS-canonical action receipts; each carries action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms})) usable as TRACE external execution evidence (trace-spec #34).", - "path": "integrations/nobulex", - "url": "https://github.com/agentrust-io/integrations/tree/main/integrations/nobulex", - "homepage": "https://nobulex.com", - "repository": "https://github.com/arian-gogani/nobulex", - "tier": "verified", + "name": "MUSUBI trace terms", + "package_name": "MUSUBI trace terms", + "vendor": "The HORIZONs Co., Ltd.", + "description": "Judges PIC/TRACE authorizations and Trust Records, read unchanged, against a contract and terms two parties signed, per call and overall: within, outside, undetermined or refused.", + "path": "integrations/horizonshield-musubi-trace-terms", + "url": "https://github.com/agentrust-io/integrations/tree/main/integrations/horizonshield-musubi-trace-terms", + "homepage": null, + "repository": "https://github.com/ogasurfproject-jpg/horizon-shield", + "tier": "community", "stack": [ "TRACE" ], "category": "Evidence & receipts", - "mark": "NX", + "mark": "MT", "featured": null, "keywords": [ - "receipts", - "Ed25519", - "evidence" + "contract", + "authorization", + "pic-trace-bridge", + "trust-record", + "terms", + "counts" ] }, { @@ -787,7 +790,7 @@ "path": "integrations/parmana-server", "url": "https://github.com/agentrust-io/integrations/tree/main/integrations/parmana-server", "homepage": "https://docs.parmanasystems.com", - "repository": "https://github.com/pavancharak/parmana", + "repository": "https://github.com/pavancharak/parmana-core", "tier": "verified", "stack": [ "TRACE" @@ -812,7 +815,7 @@ "url": "https://github.com/agentrust-io/integrations/tree/main/integrations/pic-standard-mcp-guard", "homepage": "https://github.com/pic-standard/pic-standard", "repository": "https://github.com/agentrust-io/integrations", - "tier": "community", + "tier": "verified", "stack": [ "TRACE" ], diff --git a/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell.py b/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell.py index f23a4ccd..daec2d60 100644 --- a/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell.py +++ b/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell.py @@ -24,6 +24,7 @@ "https://github.com/agentrust-io/integrations/tree/main/integrations/openshell" ) _MODES = {"enforce", "advisory", "silent"} +_LIMIT = 2**53 - 1 def _canonical_json(value: Any) -> bytes: @@ -172,9 +173,15 @@ def build_transcript( """Build the canonical transcript and return its bytes and action count.""" if not sandbox_id or not sandbox_id.strip(): raise MissingEvidence("sandbox_id is required to correlate OpenShell and ACS evidence") - if not capture_complete: + if type(capture_complete) is not bool or not capture_complete: raise MissingEvidence("capture is incomplete; refusing to present a partial log as a transcript") - if capture_start < 0 or capture_end < capture_start: + if ( + type(capture_start) is not int + or type(capture_end) is not int + or capture_start < 0 + or capture_end < capture_start + or capture_end > _LIMIT + ): raise ValueError("capture_start and capture_end must be ordered Unix milliseconds") if not openshell_version or not openshell_version.strip(): raise MissingEvidence("openshell_version is required to validate OCSF provenance") diff --git a/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell_bundle.py b/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell_bundle.py index 6fc87b30..0c3d2121 100644 --- a/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell_bundle.py +++ b/packages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell_bundle.py @@ -102,6 +102,8 @@ def verify_bundle( try: encoded = _text(signature["signature"]) signed = base64.b64decode(encoded, validate=True) + if len(signed) != 64 or base64.b64encode(signed).decode("ascii") != encoded: + raise ValueError("non-canonical 64-byte base64 signature") key.verify(signed, manifest_bytes) except (ValueError, InvalidSignature) as exc: raise BundleError("invalid gateway signature") from exc diff --git a/packages/agentrust-trace-adapters/tests/test_openshell_bundle.py b/packages/agentrust-trace-adapters/tests/test_openshell_bundle.py index ab4f65e5..f2cb055a 100644 --- a/packages/agentrust-trace-adapters/tests/test_openshell_bundle.py +++ b/packages/agentrust-trace-adapters/tests/test_openshell_bundle.py @@ -270,3 +270,38 @@ def test_malformed_signed_jsonl(producer): ).encode() with pytest.raises(BundleError, match="JSON"): check(producer, (raw, sig, files)) + + +def test_non_canonical_base64_signature_and_boolean_capture_bounds_rejected(producer): + from agentrust_trace_adapters.openshell import MissingEvidence, build_transcript + + raw, sig, files = producer[0]() + envelope = json.loads(sig) + # 64 zero bytes with non-zero trailing padding bits before '==' ('B==' instead of 'A==') + envelope["signature"] = "A" * 85 + "B==" + with pytest.raises(BundleError, match="signature"): + check(producer, (raw, json.dumps(envelope).encode(), files)) + + with pytest.raises(ValueError, match="capture_start"): + build_transcript( + sandbox_id="sandbox-a", + policy_bundle_hash="sha256:" + "a" * 64, + ocsf_jsonl=files["events.ocsf.jsonl"], + acs_decisions=[{"allow": True}], + capture_start=False, + capture_end=True, + capture_complete=True, + openshell_version="synthetic", + ) + with pytest.raises(MissingEvidence, match="incomplete"): + build_transcript( + sandbox_id="sandbox-a", + policy_bundle_hash="sha256:" + "a" * 64, + ocsf_jsonl=files["events.ocsf.jsonl"], + acs_decisions=[{"allow": True}], + capture_start=100, + capture_end=200, + capture_complete="yes", # type: ignore[arg-type] + openshell_version="synthetic", + ) + diff --git a/requirements/provenance.txt b/requirements/provenance.txt index 763a0745..cbebd978 100644 --- a/requirements/provenance.txt +++ b/requirements/provenance.txt @@ -4,9 +4,9 @@ annotated-types==0.8.0 \ --hash=sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7 \ --hash=sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0 # via pydantic -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via requests cffi==2.1.1 ; platform_python_implementation != 'PyPy' \ --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \ diff --git a/requirements/release.txt b/requirements/release.txt index 65c4c098..7f5219f0 100644 --- a/requirements/release.txt +++ b/requirements/release.txt @@ -8,9 +8,9 @@ build==1.6.1 \ --hash=sha256:51cc11666391ab6f092070437ac747002ff46f3e4113a3622177ee6b488bfc53 \ --hash=sha256:ecd351a4be9d35a9eaaba244a7687143c9c7d4aea6ac964e7e7ddab20cbcf4e7 # via -r requirements/release.in -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via requests cffi==2.1.1 ; platform_machine != 'ppc64le' and platform_machine != 's390x' and platform_python_implementation != 'PyPy' and sys_platform == 'linux' \ --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \ diff --git a/requirements/sdk-google-adk.txt b/requirements/sdk-google-adk.txt index 9797da9a..d9f1e9b5 100644 --- a/requirements/sdk-google-adk.txt +++ b/requirements/sdk-google-adk.txt @@ -33,9 +33,9 @@ authlib==1.8.0 \ --hash=sha256:88aebbd9af6757e14e912d5dc007ae1dc1f3e27e3b2152ce7c552ee2c3b3c121 \ --hash=sha256:f3ecd5f1da737262fb53bf1a4d95c4ea1ad9dd509316587a255c99ab1838a4f0 # via google-adk -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx diff --git a/requirements/sdk-langchain.txt b/requirements/sdk-langchain.txt index 0297982b..ae0e3c88 100644 --- a/requirements/sdk-langchain.txt +++ b/requirements/sdk-langchain.txt @@ -11,9 +11,9 @@ anyio==4.15.1 \ # httpx # httpx2 # langsmith -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx diff --git a/requirements/sdk-openai-agents.txt b/requirements/sdk-openai-agents.txt index 57547f2e..a1c210ba 100644 --- a/requirements/sdk-openai-agents.txt +++ b/requirements/sdk-openai-agents.txt @@ -19,9 +19,9 @@ attrs==26.1.0 \ # via # jsonschema # referencing -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via requests cffi==2.1.1 \ --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \ diff --git a/requirements/sentinel-fixed.txt b/requirements/sentinel-fixed.txt index 77e00fa6..2c7c883e 100644 --- a/requirements/sentinel-fixed.txt +++ b/requirements/sentinel-fixed.txt @@ -25,9 +25,9 @@ attrs==26.1.0 \ # via # jsonschema # referencing -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via # httpcore # httpx