sage-agenttrust: record the real 2026-09-15 run and correct the C-2 conformance note

The manifest's tested_against block recorded a run that never happened: PR #61
bumped agentrust-trace 0.2.0 -> 0.5.0 mechanically across the repo, and this
bridge was actually last exercised against agentrust-trace 0.2.0 /
cmcp-runtime 0.2.1 in June.

The bridge has since been re-run against current releases and updated
(l33tdawg/sage-agenttrust@3441b3a8), so this records what was actually run:

- tested_against: agentrust-trace 0.10.0, cmcp-runtime 0.5.0, plus
  agentrust-trace-tests 0.5.1, a key the block was missing.
- The C-2 note is inverted. agentrust-trace-tests 0.5.1 loads a standalone
  TRACE record as fmt="trace"; 0.1.0 raised LoadError on it. The bare C-2
  record is therefore graded for the first time and passes Level 0, so the
  "carries no conformance level" comment is no longer true. Level 1 remains
  unclaimed: software-only has no hardware root.
- vendor: the schema defines this as "company or community project behind the
  integration" and every other entry uses an org slug. This one named the
  integration instead. Now SAGE.
- README: current package versions and the v11.19.22 image digest, the
  corrected conformance sentence, an additional reproduction bullet for the
  C-2 Level 0 / Level 1 pair, and the canonicalization note corrected to
  RFC 8785 (the library moved to rfc8785.dumps in 0.10.0; the bridge verifies
  with the same recipe).

marketplace/catalog.json regenerated per CONTRIBUTING (one field: vendor).

scripts/validate_integrations.py: 37 integrations, 0 failures.
pytest tests/test_validate_integrations.py tests/test_integration_schema.py
tests/test_generate_marketplace_catalog.py tests/test_validate_compatibility.py:
19 passed.

Author: l33tdawg

integrations/sage-agenttrust/README.md

@@ -29,38 +29,39 @@ Two paths:
   **no** per-write binding and the agent controls the gateway key, so C-1 is provenance that an
   agent ran behind an attested gateway — **not** per-write authorization.
 
-**What it does not claim:** the bridge does **not** verify any hardware root of trust with the
-published AgenTrust stack — `cmcp_verify`'s per-platform verifiers check the measurement
-format/parse but **defer the silicon root** (TPM EK chains / AMD VCEK / Intel DCAP quote
-signatures go to *unverified_fields*, "out of scope for Phase 1"), and a C-2 record's
-`runtime.platform` is self-asserted. So it **never** reports
+**What it does not claim:** the bridge does **not** verify any hardware root of trust, because it
+pins none. `cmcp_verify` 0.5.0 does carry real silicon-root checks now (TPM AK/EK chains to a
+pinned manufacturer CA, AMD VCEK/VLEK, Intel DCAP quotes), but they only run when the caller pins
+a trusted root. So it **never** reports
 `hardware_backed`; `verification` is always `edge-only` and a claimed TEE platform is surfaced
 only as `platform_claimed` (unverified). Attestation here authenticates the *author and policy*
 of a write — **not** the truth of the content (SAGE's content hash and confidence stay
 client-asserted). Verification is at the edge (the digest is not re-checked in SAGE consensus —
 proposed upstream, not shipped); the badge reflects edge-verification at submit (`proposed`)
-time, not consensus commit. `agentrust-trace-tests` **rejects** a self-signed bare TRACE record
-(`LoadError`: a `signature` field without `cmcp_version`) and never grades it, so we make **no**
-conformance-level claim for the C-2 path; the cMCP-envelope form passes `agentrust-trace-tests`
-**0.1.0** Level 0. The `ReplayCache` (byte-identical de-dup) only blocks naive third-party
+time, not consensus commit. **Both paths are graded, and both pass Level 0:** the cMCP-envelope
+form as before, and the self-signed bare TRACE record since `agentrust-trace-tests` 0.5.1 began
+loading it as `fmt="trace"` (0.1.0 raised `LoadError` on it, so the C-2 path previously carried no
+conformance claim at all). Level 1 is correctly **not** claimed — software-only has no hardware
+root. The `ReplayCache` (byte-identical de-dup) only blocks naive third-party
 replay, not the minting agent, is **process-local** (a multi-instance deployment needs a shared
 store) and effective single-instance only. The `GET /v1/attestation/{memory_id}` badge endpoint
 is **unauthenticated** read-only — no secrets, but it discloses the attestation digest, `cnf`
-thumbprint, and SPIFFE subject for a known `memory_id`. Canonicalization follows
-`agentrust_trace`'s recipe (sorted-keys JSON), which equals RFC 8785 / JCS only for ASCII string
-+ integer-number content.
+thumbprint, and SPIFFE subject for a known `memory_id`. Canonicalization is RFC 8785 (JCS):
+`agentrust_trace` 0.10.0 signs with `rfc8785.dumps` and the bridge verifies with the same recipe,
+so the bytes it accepts are the bytes a spec-conformant third-party verifier computes.
 
 ## Run it
 
-Against released packages (`cmcp-runtime` 0.2.1, `agentrust-trace` 0.2.0):
+Against released packages (`cmcp-runtime` 0.5.0, `agentrust-trace` 0.10.0,
+`agentrust-trace-tests` 0.5.1) and a stock SAGE `v11.19.22` node:
 
 ```bash
 git clone https://github.com/l33tdawg/sage-agenttrust && cd sage-agenttrust
 python -m venv .venv && . .venv/bin/activate && pip install -e ".[dev]"
 
 # stock SAGE node, isolated in Docker (image pinned by digest for reproducibility)
 docker run -d --name sage-demo -p 127.0.0.1:18080:8080 -e SAGE_PASSPHRASE=demo-passphrase \
-  ghcr.io/l33tdawg/sage@sha256:f08ebd392638d28248a06dab5791d975041e635a5c814c7e57e7632c3c10c05d serve
+  ghcr.io/l33tdawg/sage@sha256:380fcae7b86712d5882a8c3676265d976d7a96a3eeed74559079994cd63f6b0a serve
 
 # the attestation-verifying proxy
 SAGE_UPSTREAM=http://127.0.0.1:18080 uvicorn bridge.app:app --port 19090 &
@@ -80,6 +81,8 @@ BRIDGE_URL=http://127.0.0.1:19090 python demo/run_demo.py
   when it names a different agent or its policy/catalog hash does not match the approved set.
 - The cMCP `RuntimeClaim` **passes `agentrust-trace-tests` Level 0**, and `software-only`
   **fails Level 1** (no hardware root) — asserted in `tests/test_conformance.py`.
+- The standalone C-2 Trust Record **passes `agentrust-trace-tests` Level 0** and `software-only`
+  **fails Level 1**, the same pair as the cMCP envelope — asserted in `tests/test_conformance.py`.
 
 `demo/run_demo.py` reproduces the live chain against a stock SAGE container: an attested
 submit reaches consensus `committed`, the badge is retrievable, and a tampered or

integrations/sage-agenttrust/integration.yaml

@@ -1,5 +1,5 @@
 name: SAGE AgenTrust Bridge
-vendor: SAGE AgenTrust Bridge
+vendor: SAGE
 integrates_with:
   - cmcp
   - trace
@@ -18,11 +18,13 @@ marketplace:
   category: Security & policy
   mark: SG
   keywords: [memory, proxy, consensus]
-# Level the cMCP-RuntimeClaim (envelope) path passes; the bare C-2 TRACE record is not graded
-# by agentrust-trace-tests (LoadError), so it carries no conformance level — see README.
+# Both paths pass Level 0: the cMCP-RuntimeClaim (envelope) form, and — since
+# agentrust-trace-tests 0.5.1 loads a standalone TRACE record as fmt="trace" — the bare C-2
+# record the bridge mints. Level 1 is not claimed: software-only has no hardware root.
 trace_conformance_level: 0
 trace_roles:
   - record-consumer
 tested_against:
-  cmcp-runtime: "0.2.1"
-  agentrust-trace: "0.5.0"
+  cmcp-runtime: "0.5.0"
+  agentrust-trace: "0.10.0"
+  agentrust-trace-tests: "0.5.1"

marketplace/catalog.json

@@ -543,7 +543,7 @@
     {
       "name": "SAGE AgenTrust Bridge",
       "package_name": "SAGE AgenTrust Bridge",
-      "vendor": "SAGE AgenTrust Bridge",
+      "vendor": "SAGE",
       "description": "Reverse proxy that edge-verifies a TRACE record (key-equal) or cMCP RuntimeClaim (gateway-asserted) before admitting a memory submit to a stock, unmodified SAGE consensus-memory node.",
       "path": "integrations/sage-agenttrust",
       "url": "https://github.com/agentrust-io/integrations/tree/main/integrations/sage-agenttrust",