fix(schema): an external-evidence-source declares no TRACE conformance level (#179)

The template showed `trace_conformance_level` and `trace_roles` as a pair and
listed external-evidence-source as one of the role options, so a contributor
following it pairs the two. That is how aeoess-aps came to carry
`trace_conformance_level: 0` for a mapper that issues no Trust Record of its own
(#170, corrected by #178).

The schema already required a level of anyone claiming record-producer or
record-consumer. It did not forbid one from an integration claiming neither, so
nothing caught the pairing. The mirror rule is now expressed: when trace_roles
is present and contains neither producer nor consumer, trace_conformance_level
must be absent.

The template says the same thing in prose, and now says it the way the WCM half
of the same file already did: roles say what you do, and a role that verifies or
issues nothing of its own declares no level.

Verified against all 36 integrations, which all already comply: nobulex and
computeid-agentpassport-trace carry external-evidence-source with no level, and
every producer or consumer carries one. Checked in both directions, including
that a record-producer with no level is still refused and that an integration
holding both roles keeps its level.


Claude-Session: https://claude.ai/code/session_01X27MBo6tGVw1UmmchuGFnW

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: imran-siddique

integrations/_template/integration.yaml

@@ -16,10 +16,15 @@ marketplace:
   mark: EX                   # 1-3 letters/numbers shown when no logo is available
 # featured is maintainer-curated; do not add it to new submissions
 # keywords: [framework, use-case]
-# Required if you emit or consume TRACE records:
-# trace_conformance_level: 1
+# Required if you emit or consume TRACE records. Roles say what you do; the level
+# says which `trace-tests` level your own records reach. An external-evidence-source
+# maps somebody else's signed evidence into TRACE shape and issues no Trust Record of
+# its own, so it declares no level. See integrations/nobulex and
+# integrations/aeoess-aps.
 # trace_roles:
 #   - record-producer  # or record-consumer / external-evidence-source
+# Only for record-producer and record-consumer:
+# trace_conformance_level: 1
 # Required if you integrate with WCM. Roles say what you do; levels say which
 # `wcm conformance` layers you pass. attestation-source and evidence-consumer
 # verify no manifest and therefore declare no level.

schema/integration.schema.json

@@ -177,6 +177,20 @@
       },
       "then": { "required": ["trace_conformance_level"] }
     },
+    {
+      "$comment": "The mirror of the rule above. An external-evidence-source maps somebody else's signed evidence into TRACE shape and issues no Trust Record of its own, so it has no level of its own to claim. integrations/_template/integration.yaml previously showed the two as a pair, which is how aeoess-aps came to carry a level it could not support (integrations#170).",
+      "if": {
+        "required": ["trace_roles"],
+        "not": {
+          "properties": {
+            "trace_roles": {
+              "contains": { "enum": ["record-producer", "record-consumer"] }
+            }
+          }
+        }
+      },
+      "then": { "not": { "required": ["trace_conformance_level"] } }
+    },
     {
       "if": {
         "properties": {