fix: the example script made the same withdrawn claim as the test

emit_record.py called verify_record on the signed partial record and its
docstring advertised that the output was "verifiable with
agentrust_trace.verify_record". Both are the claim agentrust-trace 0.10.0
withdrew, so the conformance job failed at "Emit a sample TRACE record"
rather than in the tests.

The script now signs and stops there, saying why in a comment: asking for
a verdict the format cannot honestly give would either fail the example
or push someone to invent a model identity. The docstring says what the
signed file actually is, a record whose signature checks out and which
verify_record refuses, and points at the "Deliberately absent" section
for the reason. Level 0 is the claim and the job runs it on the next line.

Also fixes a relative path: the capture-core core-tests job runs from
packages/agentrust-capture-core, so its lock is ../../requirements/.

Verified: the script emits, trace-tests verify --level 0 returns PASS
with the expected single UNVERIFIED on the unsigned artifact, and all 28
aeoess-aps tests pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t

Author: imran-siddique

.github/workflows/capture-core-tests.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Run core tests
         working-directory: packages/agentrust-capture-core
         run: |
-          pip install --require-hashes -r requirements/capture-core.txt
+          pip install --require-hashes -r ../../requirements/capture-core.txt
           python -m pytest tests -q
 
   # The engines import the core as a hard dependency now, so the thing worth

integrations/aeoess-aps/examples/emit_record.py

@@ -14,8 +14,13 @@
 Two files are written:
 
   <out>              Unsigned record, the artifact ``trace-tests verify`` grades
-  <out>.signed.json  Signed record, verifiable with
-                     ``agentrust_trace.verify_record(..., allow_embedded_key=True)``
+  <out>.signed.json  The same record, signed. Its signature checks out, but
+                     ``agentrust_trace.verify_record`` refuses it: from 0.10.0
+                     that function enforces the full v0.2 schema, and this
+                     record deliberately omits ``model``, ``data_class`` and
+                     ``build_provenance`` (see "Deliberately absent" in
+                     aps_trace.py). ``trace-tests verify --level 0`` is the
+                     gate this integration targets, and it passes.
 
 Usage:
     python examples/emit_record.py --out trust-record.jwt
@@ -89,7 +94,12 @@ def main() -> int:
     record = build_trace_record(decision, trace_jwk=jwk)
 
     signed = agentrust_trace.sign_record(dict(record), key)
-    agentrust_trace.verify_record(signed, allow_embedded_key=True, max_age_seconds=None)
+
+    # Deliberately not calling verify_record here. Since agentrust-trace 0.10.0
+    # it enforces the full v0.2 schema, and this record is a documented partial:
+    # asking for a verdict it cannot honestly give would either fail the example
+    # or push someone to invent a model identity. Level 0 is the claim, and the
+    # conformance job runs it on the unsigned artifact immediately after this.
 
     out = Path(args.out)
     out.write_text(
@@ -106,7 +116,7 @@ def main() -> int:
     print(f"appraisal.status: {record['appraisal']['status']}")
     print(f"subject:          {record['subject']}")
     print(f"unsigned (for trace-tests): {out}")
-    print(f"signed   (verify_record OK): {signed_out}")
+    print(f"signed   (signature only, partial record): {signed_out}")
     return 0