fix(claude-code): sign the TRACE record with the persisted key, not a fresh one (#180)

sign_all called agentrust_trace.generate_key() per record, so the private half
was discarded immediately and the only copy of the public half was the cnf.jwk
inside the record itself. agentrust_trace.verify_record refuses that by
default:

  ValueError: verify_record requires a trusted key. Pass an Ed25519PublicKey
  or JWK dict, or set allow_embedded_key=True to (insecurely) trust the key
  embedded in record.cnf.jwk.

and with the flag on it warns that this "proves the record is internally
consistent, NOT that it came from a trusted issuer". So the signature on a
per-session signed Trust Record attested to nothing about its origin, which is
the property the record exists to carry. Anyone can generate a key, sign a
record and embed the public half.

It also gave the agent a new TRACE identity every session. Three records
captured on this machine in August carry three different cnf.jwk keys
(EQRU0ZFB..., tjOZOANU..., FJscFYnI...) while their manifests all share key
92d6daa1.... An identity that changes per session cannot be pinned out of band
and cannot be registered as a trace-registry producer, because the registry
looks a producer key up from producers/ rather than trusting the key a claim
names for itself.

The record now uses the keypair the manifest already uses, persisted at
~/.claude/agentrust/signing_key.json, whose public half is published beside
every record as verification_key.json. Third parties verify both files with
that one key, and the note in it says so.

Records emitted before this change cannot be retrofitted; their signing keys
are gone.

The test suite asserted the manifest was externally verifiable and never asked
the same of the record, which is why this survived three sessions. Two tests
now mirror that assertion: the record verifies under the published key with no
allow_embedded_key, refuses a different key, and the manifest and record share
one key across two runs. Both fail against the previous behaviour, checked by
reverting. 61 pass.


Claude-Session: https://claude.ai/code/session_01X2GDChXjA7BAdDNzCAmBJv

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: imran-siddique

claude-code/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to the AgenTrust for Claude Code plugin.
 
 ## Unreleased
 
+### Fixed
+- **The TRACE Trust Record is signed with the plugin's persisted key, not a
+  throwaway one.** `sign_all` called `agentrust_trace.generate_key()` for each
+  record, so the private half was discarded at once and the only copy of the
+  public half was the `cnf.jwk` inside the record itself.
+  `agentrust_trace.verify_record` refuses that by default and warns when forced
+  with `allow_embedded_key=True` that it "proves the record is internally
+  consistent, NOT that it came from a trusted issuer" - so the signature
+  attested to nothing about origin, which is the property the record exists to
+  carry. It also gave the agent a new TRACE identity every session: three
+  records captured locally in August carry three different keys, where their
+  manifests all share one.
+
+  The record now shares the key that signs the manifest, whose public half is
+  already published beside it as `verification_key.json`. That makes the record
+  verifiable by a third party holding only that file, and makes the identity
+  stable enough to pin out of band or register as a trace-registry producer,
+  which a per-session key can never be.
+
+  Records emitted before this change cannot be retrofitted; their signing keys
+  no longer exist. Re-run `/trace` to emit a verifiable one.
+
+  Found because the test suite asserted the manifest was externally verifiable
+  and never asked the same of the record. It does now, and both new tests fail
+  against the previous behaviour.
+
 ### Breaking
 - Drift detection now requires the separately published
   `agentrust-capture-core` package; the previous vendored fallback was removed.

claude-code/engine/capture.py

@@ -451,7 +451,7 @@ def build_trace(cur: dict) -> dict:
 def sign_all(cur: dict, outdir: Path) -> tuple[dict, dict]:
     try:
         from agent_manifest import Ed25519Signer, Ed25519Verifier, Manifest
-        from agentrust_trace import generate_key, sign_record
+        from agentrust_trace import sign_record
     except ImportError as e:
         raise SystemExit(
             "Signing needs the crypto packages, which are not installed. Run:\n"
@@ -467,19 +467,28 @@ def sign_all(cur: dict, outdir: Path) -> tuple[dict, dict]:
     manifest["signature"] = Ed25519Signer(kp).sign(manifest)
     Ed25519Verifier(kp.public_bytes).verify(manifest, manifest["signature"]["signature_value"])
 
-    trace = sign_record(build_trace(cur), generate_key())
+    # The same persisted key that signs the manifest, not a fresh one. A record
+    # signed by a throwaway key keeps its only public half inside its own
+    # cnf.jwk, and agentrust_trace.verify_record refuses that by default:
+    # trusting the key a record names proves the record is internally
+    # consistent, not that it came from anyone. It also gave the agent a new
+    # TRACE identity every session, so the key could never be pinned out of
+    # band or registered as a producer.
+    trace = sign_record(build_trace(cur), kp.private_key)
 
     outdir.mkdir(parents=True, exist_ok=True)
     (outdir / "manifest.json").write_text(json.dumps(manifest, indent=2), encoding="utf-8")
     (outdir / "trace.json").write_text(json.dumps(trace, indent=2), encoding="utf-8")
-    # Publish the public key so a third party can verify manifest.json without
-    # trusting this machine: load it into the verifier's trusted_keys as
-    # {key_id: public_key_b64url}. The private key never leaves ~/.claude.
+    # Publish the public key so a third party can verify manifest.json and
+    # trace.json without trusting this machine: load it into the verifier's
+    # trusted_keys as {key_id: public_key_b64url}. The private key never leaves
+    # ~/.claude.
     verification_key = {
         "algorithm": "Ed25519",
         "key_id": kp.key_id,
         "public_key_b64url": kp.public_b64url(),
-        "note": "load as {key_id: public_key_b64url} into the verifier's trusted_keys",
+        "note": "load as {key_id: public_key_b64url} into the verifier's trusted_keys; "
+                "verifies both manifest.json and trace.json, which share this key",
     }
     (outdir / "verification_key.json").write_text(
         json.dumps(verification_key, indent=2), encoding="utf-8"

claude-code/tests/test_claude_code_capture.py

@@ -5,6 +5,7 @@
 """
 from __future__ import annotations
 
+import base64
 import importlib.util
 import json
 from pathlib import Path
@@ -543,6 +544,69 @@ def test_manifest_is_externally_verifiable_and_tamper_evident(tmp_path, monkeypa
     assert bad.signature_verified is False
 
 
+def test_trace_record_is_externally_verifiable_with_the_published_key(tmp_path, monkeypatch):
+    """The mirror of the manifest test above, which is why this was missed.
+
+    The manifest had this test and the trace record did not, so the trace
+    record was signed with agentrust_trace.generate_key() for three sessions
+    and nobody noticed. A record signed by a throwaway key keeps its only
+    public half inside its own cnf.jwk, and verify_record refuses that by
+    default: it proves the record is internally consistent, not that it came
+    from anyone.
+    """
+    pytest.importorskip("agentrust_trace")
+    pytest.importorskip("cryptography")
+    from agentrust_trace import verify_record
+
+    _point_signing_key(tmp_path, monkeypatch)
+    out = tmp_path / "records"
+    cur = capture.snapshot({"model_id": "claude-x", "builtin_tools": ["Bash"], "mcp_servers": []})
+    _manifest, trace = capture.sign_all(cur, out)
+
+    vk = json.loads((out / "verification_key.json").read_text(encoding="utf-8"))
+    jwk = {"kty": "OKP", "crv": "Ed25519", "x": vk["public_key_b64url"]}
+
+    # A third party holding only the published public key verifies the record.
+    # No allow_embedded_key: that flag is the insecure path this test exists to
+    # keep us off, and verify_record raises without either.
+    verify_record(trace, jwk, max_age_seconds=None)
+
+    # And the record must not be verifiable under some other key.
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+    other = Ed25519PrivateKey.generate().public_key().public_bytes_raw()
+    other_jwk = {"kty": "OKP", "crv": "Ed25519",
+                 "x": base64.urlsafe_b64encode(other).decode().rstrip("=")}
+    with pytest.raises(Exception):
+        verify_record(trace, other_jwk, max_age_seconds=None)
+
+
+def test_manifest_and_trace_share_one_stable_identity(tmp_path, monkeypatch):
+    """Two sessions, one key, and the same key across both record types.
+
+    A TRACE identity that changes every session cannot be pinned out of band,
+    so it can never be registered as a trace-registry producer. Registering a
+    producer is the whole point of a stable signing identity.
+    """
+    pytest.importorskip("agentrust_trace")
+    pytest.importorskip("cryptography")
+
+    _point_signing_key(tmp_path, monkeypatch)
+    cur = capture.snapshot({"model_id": "claude-x", "builtin_tools": [], "mcp_servers": []})
+
+    first_manifest, first_trace = capture.sign_all(cur, tmp_path / "run1")
+    second_manifest, second_trace = capture.sign_all(cur, tmp_path / "run2")
+
+    published = json.loads(
+        (tmp_path / "run1" / "verification_key.json").read_text(encoding="utf-8")
+    )["public_key_b64url"]
+
+    # The trace record names its confirmation key, and it has to be the
+    # published one rather than a per-session key.
+    assert first_trace["cnf"]["jwk"]["x"] == published
+    assert second_trace["cnf"]["jwk"]["x"] == first_trace["cnf"]["jwk"]["x"]
+    assert first_manifest["signature"]["key_id"] == second_manifest["signature"]["key_id"]
+
+
 # ---------------------------------------------------------------------------
 # Baseline integrity: the baseline is what every comparison is made against, so
 # a baseline that can be rewritten unnoticed makes the drift check pass forever.