Add EPI Recorder: TRACE Level 0 record-producer + WCM attestation-source

.github/workflows/epilabs-epi-recorder-conformance.yml

@@ -0,0 +1,38 @@
+name: epilabs-epi-recorder conformance
+on:
+  push:
+    paths: ["integrations/epilabs-epi-recorder/**"]
+  pull_request:
+    paths: ["integrations/epilabs-epi-recorder/**"]
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  conformance:
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12"]
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install released packages
+        run: |
+          python -m pip install --upgrade pip
+          pip install "epi-recorder==4.4.3" agentrust-trace agentrust-trace-tests
+      - name: Emit a sample TRACE record
+        run: python integrations/epilabs-epi-recorder/examples/emit_record.py trust-record.json
+      - name: TRACE conformance Level 0
+        run: trace-tests verify --record trust-record.json --level 0
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: conformance-${{ matrix.os }}-py${{ matrix.python }}
+          path: trust-record.json

integrations/epilabs-epi-recorder/README.md

@@ -0,0 +1,35 @@
+# EPI Recorder TRACE / WCM attestation source
+
+`epi export trace` maps a sealed `.epi` file to a TRACE v0.2 **log-import** Trust Record. `tool_transcript.hash` is `sha256` of the `.epi` bytes. This is **Level 0** (software-only). It does **not** claim TEE attestation, Cedar evaluation, or a TRACE verifier appraisal (`appraisal.status` is `none`). WCM role is `attestation-source`: evidence for someone else's verifier; this integration does not verify a WCM manifest.
+
+## Run it
+
+Against the published PyPI release:
+
+```bash
+pip install "epi-recorder==4.4.3" agentrust-trace agentrust-trace-tests
+epi record --out demo.epi -- python -c "print('ok')"
+epi export trace demo.epi --out demo.trace.json
+trace-tests verify --record demo.trace.json --level 0
+```
+
+Release artifacts: [v4.4.3](https://github.com/mohdibrahimaiml/epi-recorder/releases/tag/v4.4.3) (`build-v4.4.3.epi`, `build-v4.4.3.trace.json`).
+
+## What is verified
+
+A reviewer can:
+
+1. `pip install epi-recorder==4.4.3` from PyPI (not an editable checkout).
+2. Export TRACE JSON and run `trace-tests verify --level 0`. Expect **Level 0** only. L1/L2 fail `TR-RTE-001` (software-only) and `TR-RTE-004` (nonce) by design.
+3. Confirm `tool_transcript.hash` equals `sha256:` of the `.epi` file.
+4. Tamper the record signature → `InvalidSignature`.
+
+Conformance digest (Level 0, `iter_errors=0`, `origin.producer=epi-recorder/4.4.3`): `sha256:d17f305b7f3e9950614df5ae6810b86b111c6a9aa23c37c71cac5dd503da591f`.
+
+Seal completeness (truncation through 4.4.1; 4.4.3 seals full payloads): [historical step-content truncation](https://github.com/mohdibrahimaiml/epi-recorder/blob/v4.4.3/docs/KNOWN_LIMITATIONS.md#historical-step-content-truncation-through-441).
+
+Byte-level seal map: [byte-level seal scope](https://github.com/mohdibrahimaiml/epi-recorder/blob/v4.4.3/docs/KNOWN_LIMITATIONS.md#byte-level-seal-scope-from-1kb-sweep-440-demo-banking-amlepi-405612-b).
+
+## Verified tier request
+
+Please evaluate this integration for the **Verified** tier. Reproduction is the four steps above against `epi-recorder==4.4.3` and `agentrust-trace-tests==0.5.1`.

integrations/epilabs-epi-recorder/examples/emit_record.py

@@ -0,0 +1,26 @@
+"""Emit a Level 0 TRACE record from a freshly sealed .epi (CI / reviewer)."""
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+
+def main() -> None:
+    out_dir = Path("ci-out")
+    out_dir.mkdir(exist_ok=True)
+    epi = out_dir / "demo.epi"
+    rec = Path(sys.argv[1]) if len(sys.argv) > 1 else out_dir / "trust-record.json"
+    subprocess.run(
+        [sys.executable, "-m", "epi_cli", "record", "--out", str(epi), "--", sys.executable, "-c", "print('epi-trace')"],
+        check=True,
+    )
+    subprocess.run(
+        [sys.executable, "-m", "epi_cli", "export", "trace", str(epi), "--out", str(rec)],
+        check=True,
+    )
+    print(rec.resolve())
+
+
+if __name__ == "__main__":
+    main()

integrations/epilabs-epi-recorder/integration.yaml

@@ -0,0 +1,29 @@
+name: EPI Recorder
+vendor: EPI Labs
+integrates_with:
+  - trace
+  - wcm
+description: >-
+  Seals a portable .epi evidence file and emits a TRACE v0.2 log-import
+  Trust Record (Level 0) via epi export trace; .epi hash is the transcript.
+maintainer:
+  github: mohdibrahimaiml
+  email: mohdibrahim@epilabs.org
+repository: https://github.com/mohdibrahimaiml/epi-recorder
+homepage: https://epilabs.org
+license: MIT
+tier: community
+marketplace:
+  display_name: EPI Recorder
+  category: Evidence & receipts
+  mark: EPI
+  keywords: [evidence, seal, log-import, .epi]
+trace_roles:
+  - record-producer
+trace_conformance_level: 0
+wcm_roles:
+  - attestation-source
+tested_against:
+  epi-recorder: "4.4.3"
+  agentrust-trace: "0.9.0"
+  agentrust-trace-tests: "0.5.1"

marketplace/catalog.json

@@ -1,6 +1,6 @@
 {
   "catalog_version": 1,
-  "count": 34,
+  "count": 35,
   "integrations": [
     {
       "name": "Claude Code",
@@ -316,6 +316,30 @@
         "policy"
       ]
     },
+    {
+      "name": "EPI Recorder",
+      "package_name": "EPI Recorder",
+      "vendor": "EPI Labs",
+      "description": "Seals a portable .epi evidence file and emits a TRACE v0.2 log-import Trust Record (Level 0) via epi export trace; .epi hash is the transcript.",
+      "path": "integrations/epilabs-epi-recorder",
+      "url": "https://github.com/agentrust-io/integrations/tree/main/integrations/epilabs-epi-recorder",
+      "homepage": "https://epilabs.org",
+      "repository": "https://github.com/mohdibrahimaiml/epi-recorder",
+      "tier": "community",
+      "stack": [
+        "TRACE",
+        "WCM"
+      ],
+      "category": "Evidence & receipts",
+      "mark": "EPI",
+      "featured": null,
+      "keywords": [
+        "evidence",
+        "seal",
+        "log-import",
+        ".epi"
+      ]
+    },
     {
       "name": "GCP Confidential Space",
       "package_name": "WCM GCP Confidential Space",