Skip to content

docs: clarify industrial evidence continuity #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 1 commit into from
Jun 12, 2026
Merged

docs: clarify industrial evidence continuity #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ End-to-end integration examples showing cMCP, Agent Manifest, and TRACE working
|---|---|---|---|
| `financial-services/` | Payment agent with Cedar policy: blocks PII in tool call parameters | SEV-SNP / TDX | EU AI Act Art. 9/12, DORA Art. 9 |
| `healthcare/` | Clinical decision agent with HITL approvals and EU AI Act Art. 14 compliance records | SEV-SNP / TDX | EU AI Act Art. 14, HIPAA |
| `industrial-embodied-ai/` | Material-movement agent with cMCP authorization and an independent safety-controller boundary | TEE / software-only development mode | OT security and industrial robot safety references |
| `industrial-embodied-ai/` | Material-movement agent with cMCP authorization, an independent safety-controller boundary and offline-verifiable closed-session evidence | TEE / software-only development mode | OT security and industrial robot safety references |
| `multi-tenant-saas/` | SaaS platform with per-tenant policy isolation | TDX | Customer contract SLA |
| `startup-tpm/` | 15-minute quickstart on any cloud VM with Trusted Launch | TPM 2.0 | Development / staging |

Expand Down
95 changes: 69 additions & 26 deletions industrial-embodied-ai/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,18 @@ End-to-end example of an AI agent requesting motion from an industrial robot
cell through cMCP, with Agent Manifest declarations and a runtime-issued TRACE
Trust Record.

The example also demonstrates evidence continuity: after the governed session
closes, its saved TRACE Trust Record and audit bundle remain verifiable after
the agent, cMCP Runtime and mock controller stop. This is continuity of
evidence, not continuity of agent memory, reputation or process identity.

The scenario is synthetic. It uses no robot hardware, vendor SDK, production
endpoint, or proprietary industrial data.

## What the example demonstrates

The agent runs three paths through a live cMCP Runtime:
The agent runs three paths through a live cMCP Runtime, then closes the session
to produce durable evidence:

1. **Allowed and completed:** cMCP authorizes the declared workflow, then the
independent controller accepts and completes the simulated motion.
Expand All @@ -18,6 +24,9 @@ The agent runs three paths through a live cMCP Runtime:
3. **Safety rejected:** cMCP authorizes the declared workflow, but the
controller rejects motion after its current state reports a person in the
safeguarded area.
4. **Closed-session evidence:** cMCP signs a TRACE Trust Record and audit
bundle that can be verified from the saved files without a running agent,
runtime or controller.

The third path is the central boundary:

Expand All @@ -28,19 +37,19 @@ The third path is the central boundary:
## Architecture

```text
Material-movement agent
|
| MCP tools/call
v
+--------------------------+ Agent Manifest declares:
| cMCP Runtime | <--- agent, prompt, policy and tool hashes
| - attested tool catalog |
| - Cedar authorization |
| - hash-chained audit |
+------------+-------------+
|
| authorized request
v
Signed Agent Manifest Material-movement agent
- agent identity declaration |
- prompt, policy and tool hashes | MCP tools/call
| v
| offline validator +--------------------------+
+-- compares hashes ------> | cMCP Runtime |
| - loads policy + catalog |
| - Cedar authorization |
| - hash-chained audit |
+------------+-------------+
|
| authorized request
v
+-------------------------------+
| Independent mock controller |
| - validates fresh state token |
Expand All @@ -53,8 +62,26 @@ The third path is the central boundary:
Simulated robot execution

Session close -> signed TRACE Trust Record + signed audit bundle
Saved files remain verifiable after all three processes stop
```

The current cMCP preview loads the policy and catalog directly. It does not
ingest the Agent Manifest, so the diagram shows an offline hash comparison
rather than a native runtime binding.

## Trust chain demonstrated

| Boundary | Demonstrated behavior |
|---|---|
| Declared agent configuration | A signed Agent Manifest declares the development agent identity and hashes for its prompt, policy and tools |
| Governed tool access | cMCP intercepts each MCP request and evaluates the active Cedar policy before forwarding |
| Physical authority | The independent controller rechecks current state and remains authoritative for simulated execution |
| Durable session evidence | TRACE and the signed audit bundle bind the cMCP session, policy, catalog and tool-call transcript |

The example composes these boundaries without claiming that the developer
preview already forms one end-to-end identity and outcome proof. The precise
gaps are listed under [Evidence boundaries](#evidence-boundaries).

## Run it

Prerequisites:
Expand Down Expand Up @@ -128,6 +155,23 @@ The agent writes fresh evidence to:
These files are ignored by Git. The committed `example-*` files were captured
from a real run and remain available for offline inspection.

## Verify after shutdown

After the agent exits, stop the cMCP Runtime and mock controller. The fresh
files can still be verified locally:

```bash
cmcp verify trace-output/latest-trust-record.json \
--policy-hash sha256:c8358148d201749ebd05651ea03cf92fb3ff8cc9cf05816483c394ebc3e1cac9 \
--catalog-hash sha256:792c86ff8152fa9713d52584c084611eb4929fa5ebf3ec8271dd21f0e0aa7eeb \
--audit-bundle trace-output/latest-audit-bundle.json
```

This command reads the saved evidence and does not contact the stopped
services. The normal attestation-freshness window still applies: offline
verification means that no live runtime is required, not that an old claim
remains current indefinitely.

## Hardware-attested run

On a supported host, do not set `CMCP_DEV_MODE`. Pin the expected artifacts
Expand Down Expand Up @@ -166,30 +210,29 @@ The validator checks:
- runtime-issued TRACE schema and signature
- signed audit-bundle integrity and binding to the TRACE record

To verify fresh output using the cMCP CLI:

```bash
cmcp verify trace-output/latest-trust-record.json \
--policy-hash sha256:c8358148d201749ebd05651ea03cf92fb3ff8cc9cf05816483c394ebc3e1cac9 \
--catalog-hash sha256:792c86ff8152fa9713d52584c084611eb4929fa5ebf3ec8271dd21f0e0aa7eeb \
--audit-bundle trace-output/latest-audit-bundle.json
```

## Evidence boundaries

| Evidence | What it establishes | What it does not establish |
|---|---|---|
| Agent Manifest | The signed declaration and hashes of the approved prompt, policy and tools | That the deployed runtime loaded those artifacts |
| Agent Manifest | The signed agent identity declaration and hashes of the approved prompt, policy and tools | That cMCP loaded the manifest or bound its agent identity to the runtime session |
| cMCP decision | The active policy authorized or denied a cataloged tool request | That an authorized physical request was safe |
| TRACE Trust Record | Runtime, policy hash, catalog hash and tool-call transcript integrity | Controller acceptance, physical completion or functional-safety compliance |
| Controller response | The mock controller's decision returned during this run | A hardware-backed or independently retained execution record |
| TRACE Trust Record | cMCP session identity, runtime, policy hash, catalog hash and tool-call transcript integrity | The Agent Manifest identity, controller acceptance, physical completion or functional-safety compliance |
| Saved TRACE and audit files | The closed session can be checked after the processes stop | Continuity of agent memory, reputation or logical identity across a restart or replacement |
| Client-observed controller response | The mock controller's decision returned to the agent during this run | A signed, hardware-backed or independently retained execution record |

The current cMCP audit bundle records request hashes and authorization
decisions, but does not populate a response hash for the controller outcome.
The example therefore does not claim that TRACE proves controller acceptance
or physical completion. Binding independent controller evidence is a
follow-up design question, not something this example silently invents.

The committed TRACE subject identifies the cMCP session, while the Agent
Manifest declares a separate agent identity. The validator confirms that the
static policy and catalog hashes agree, but the current preview does not
cryptographically bind that manifest identity to the runtime session. It also
does not establish that a restarted or replacement process is the same logical
agent.

## AgentTrust artifacts

| File | Purpose |
Expand Down
Loading