Skip to content

Commit 0f164d1

Browse files
imran-siddiqueclaude
imran-siddique
and
claude
committed
Serve the TRACE v0.2 schema at its own $id
The schema declares $id https://agentrust-io.com/schema/trace-v0.2.json but nothing was published there, so the identifier 404'd. Copies the schema shipped in agentrust-trace 0.5.0 verbatim to that path, so a verifier that dereferences the $id now gets the document it names. Not a behaviour change: the schema content is byte-identical to the published package, and consumers that had it vendored are unaffected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 parent 4739cdd commit 0f164d1

1 file changed

Lines changed: 285 additions & 0 deletions

File tree

‎schema/trace-v0.2.json‎

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://agentrust-io.com/schema/trace-v0.2.json",
4+
"title": "TRACE Trust Record",
5+
"description": "A TRACE v0.2 Trust Record — hardware-attested governance evidence for an AI agent execution.",
6+
"type": "object",
7+
"required": [
8+
"eat_profile",
9+
"iat",
10+
"subject",
11+
"model",
12+
"runtime",
13+
"policy",
14+
"data_class",
15+
"build_provenance",
16+
"appraisal",
17+
"transparency",
18+
"cnf"
19+
],
20+
"properties": {
21+
"eat_profile": {
22+
"type": "string",
23+
"const": "tag:agentrust-io.com,2026:trace-v0.2",
24+
"description": "EAT profile URI identifying this as a TRACE v0.2 Trust Record."
25+
},
26+
"iat": {
27+
"type": "integer",
28+
"description": "Issued-at time as Unix epoch seconds.",
29+
"minimum": 1700000000
30+
},
31+
"subject": {
32+
"type": "string",
33+
"description": "Workload identity as a SPIFFE SVID URI.",
34+
"pattern": "^spiffe://"
35+
},
36+
"model": {
37+
"type": "object",
38+
"description": "Model identity and provenance.",
39+
"required": ["provider", "model_id"],
40+
"properties": {
41+
"provider": {
42+
"type": "string",
43+
"description": "Model provider (e.g. 'anthropic', 'openai', 'meta')."
44+
},
45+
"model_id": {
46+
"type": "string",
47+
"description": "Model identifier as used by the provider."
48+
},
49+
"version": {
50+
"type": "string",
51+
"description": "Model version or snapshot identifier."
52+
},
53+
"weights_digest": {
54+
"type": "string",
55+
"description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.",
56+
"pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
57+
},
58+
"aibom_uri": {
59+
"type": "string",
60+
"format": "uri",
61+
"description": "URI to SPDX 3.0 AI Profile or CycloneDX 1.7 ML-BOM for this model."
62+
}
63+
},
64+
"additionalProperties": false
65+
},
66+
"runtime": {
67+
"type": "object",
68+
"description": "TEE measurement chain binding the workload to hardware.",
69+
"required": ["platform", "measurement"],
70+
"properties": {
71+
"platform": {
72+
"type": "string",
73+
"enum": [
74+
"intel-tdx",
75+
"amd-sev-snp",
76+
"azure-cvm-sev-snp",
77+
"nvidia-h100",
78+
"nvidia-blackwell",
79+
"aws-nitro",
80+
"arm-cca",
81+
"google-confidential-space",
82+
"tpm2",
83+
"software-only"
84+
],
85+
"description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence."
86+
},
87+
"measurement": {
88+
"type": "string",
89+
"description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).",
90+
"pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
91+
},
92+
"rim_uri": {
93+
"type": "string",
94+
"format": "uri",
95+
"description": "URI to the vendor-published Reference Integrity Manifest for this measurement."
96+
},
97+
"nonce": {
98+
"type": "string",
99+
"description": "Freshness nonce binding the attestation report to this record (base64url, no padding)."
100+
},
101+
"firmware_version": {
102+
"type": "string",
103+
"description": "Firmware or microcode version included in the measurement."
104+
}
105+
},
106+
"additionalProperties": false
107+
},
108+
"policy": {
109+
"type": "object",
110+
"description": "Policy bundle sealed to the TEE measurement.",
111+
"required": ["bundle_hash", "enforcement_mode"],
112+
"properties": {
113+
"bundle_hash": {
114+
"type": "string",
115+
"description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.",
116+
"pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
117+
},
118+
"enforcement_mode": {
119+
"type": "string",
120+
"enum": ["enforce", "advisory", "silent"],
121+
"default": "enforce",
122+
"description": "How policy decisions were applied: enforce (block on deny), advisory (log and allow), silent (allow and suppress operational logs; the audit chain still records every would-have-denied decision). Gateways MUST default to enforce. A deployment MUST explicitly configure silent mode; it MUST NOT be the default."
123+
},
124+
"version": {
125+
"type": "string",
126+
"description": "Policy bundle version (semantic versioning recommended)."
127+
},
128+
"policy_uri": {
129+
"type": "string",
130+
"format": "uri",
131+
"description": "URI to the policy bundle for verification."
132+
}
133+
},
134+
"additionalProperties": false
135+
},
136+
"data_class": {
137+
"type": "string",
138+
"description": "Highest-sensitivity data classification of inputs and outputs processed during this execution.",
139+
"examples": ["public", "internal", "confidential", "restricted", "top-secret"]
140+
},
141+
"tool_transcript": {
142+
"type": "object",
143+
"description": "Bound hash of the MCP/A2A tool-call transcript. OPTIONAL for Phase 1 records; REQUIRED for Phase 2+.",
144+
"required": ["hash"],
145+
"properties": {
146+
"hash": {
147+
"type": "string",
148+
"description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.",
149+
"pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
150+
},
151+
"call_count": {
152+
"type": "integer",
153+
"minimum": 0,
154+
"description": "Total number of tool calls in this session."
155+
},
156+
"transcript_uri": {
157+
"type": "string",
158+
"format": "uri",
159+
"description": "URI to the full transcript on the transparency log."
160+
}
161+
},
162+
"additionalProperties": false
163+
},
164+
"delegation": {
165+
"type": "object",
166+
"description": "A2A profile: links this record to the delegating hop's Trust Record. Present when this execution acted on delegated authority; absent on a root (non-delegated) execution. A chain of these forms an offline-verifiable delegation DAG.",
167+
"required": ["parent_record_hash", "credential_id"],
168+
"properties": {
169+
"parent_record_hash": {
170+
"type": "string",
171+
"description": "SHA-256 or SHA-384 digest of the parent hop's Trust Record.",
172+
"pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
173+
},
174+
"credential_id": {
175+
"type": "string",
176+
"minLength": 1,
177+
"description": "Identifier of the delegation credential this hop acted under."
178+
}
179+
},
180+
"additionalProperties": false
181+
},
182+
"build_provenance": {
183+
"type": "object",
184+
"description": "SLSA provenance for the workload (agent code + container image).",
185+
"required": ["slsa_level", "digest"],
186+
"properties": {
187+
"slsa_level": {
188+
"type": "integer",
189+
"minimum": 0,
190+
"maximum": 3,
191+
"description": "SLSA Build Level achieved. Level 2 minimum for TRACE conformance; Level 3 for production mark."
192+
},
193+
"builder": {
194+
"type": "string",
195+
"description": "SLSA builder URI."
196+
},
197+
"digest": {
198+
"type": "string",
199+
"description": "SHA-256 or SHA-384 digest of the container image or workload binary.",
200+
"pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
201+
},
202+
"provenance_uri": {
203+
"type": "string",
204+
"format": "uri",
205+
"description": "URI to the SLSA provenance attestation on a Sigstore/Rekor or compatible log."
206+
}
207+
},
208+
"additionalProperties": false
209+
},
210+
"appraisal": {
211+
"type": "object",
212+
"description": "Verifier's EAR appraisal of the evidence (draft-ietf-rats-ar4si).",
213+
"required": ["status", "verifier"],
214+
"properties": {
215+
"status": {
216+
"type": "string",
217+
"enum": ["affirming", "warning", "contraindicated", "none"],
218+
"description": "EAR appraisal status."
219+
},
220+
"verifier": {
221+
"type": "string",
222+
"format": "uri",
223+
"description": "URI identifying the verifier that produced this appraisal."
224+
},
225+
"policy_ref": {
226+
"type": "string",
227+
"format": "uri",
228+
"description": "URI to the appraisal policy used."
229+
},
230+
"timestamp": {
231+
"type": "integer",
232+
"description": "Unix epoch seconds when the appraisal was produced."
233+
}
234+
},
235+
"additionalProperties": false
236+
},
237+
"transparency": {
238+
"type": "string",
239+
"format": "uri",
240+
"description": "SCITT receipt URI. The Trust Record is the Signed Statement; this URI resolves to the inclusion proof (Receipt) on the transparency log."
241+
},
242+
"cnf": {
243+
"type": "object",
244+
"description": "Confirmation key (RFC 8747) — binds the Trust Record to the TEE-held signing key.",
245+
"required": ["jwk"],
246+
"properties": {
247+
"jwk": {
248+
"type": "object",
249+
"description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y.",
250+
"required": ["kty"],
251+
"properties": {
252+
"kty": {"type": "string"},
253+
"crv": {"type": "string"},
254+
"x": {"type": "string"},
255+
"y": {"type": "string"},
256+
"kid": {"type": "string"}
257+
},
258+
"allOf": [
259+
{
260+
"if": {
261+
"required": ["kty"],
262+
"properties": {"kty": {"const": "OKP"}}
263+
},
264+
"then": {"required": ["crv", "x"]}
265+
},
266+
{
267+
"if": {
268+
"required": ["kty"],
269+
"properties": {"kty": {"const": "EC"}}
270+
},
271+
"then": {"required": ["crv", "x", "y"]}
272+
}
273+
]
274+
}
275+
},
276+
"additionalProperties": false
277+
},
278+
"signature": {
279+
"type": "string",
280+
"description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with only this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.",
281+
"pattern": "^[A-Za-z0-9_-]+$"
282+
}
283+
},
284+
"additionalProperties": false
285+
}

0 commit comments

Comments
 (0)