aeoess-aps: external-evidence-source, no level claim, floating and fixed CI runs - #178
Conversation
…loating and fixed runs (agentrust-io#170) Role moves from record-producer to external-evidence-source and the trace_conformance_level claim goes, on the nobulex precedent: an APS decision is signed external evidence, and the mapped record cannot carry model, data_class or build_provenance without inventing them, so it is not a TRACE Trust Record and verify_record at 0.10.0 refuses it (pinned by test_full_verify_record_refuses_a_partial_record). tested_against moves to agentrust-trace 0.10.0 / agentrust-trace-tests 0.5.1 and states the position at those versions. CI keeps the unpinned floating run as drift detection (agentrust-io#169, harness gets pinned, subject does not) and adds a fixed run that installs exactly the tested_against versions and checks they match integration.yaml. trace-tests --level 0 stays as a coverage report and is labelled as one. README drops the partial-record and Level 0 framing; the 0.9.0 revocation observations are kept as 0.9.0 results since the schema refusal at 0.10.0 precedes the revocation check. Signed-off-by: Tymofii Pidlisnyi <signal@aeoess.com>
|
🔴 Contributor Check: HIGH
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:HIGH
…arketplace catalog Signed-off-by: Tymofii Pidlisnyi <signal@aeoess.com>
|
Two CI fixes pushed in 206c589: the new metadata test no longer imports |
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head 206c589a7678fca1909d88a1dee9b6e58914d4f9.
The role correction is accurate: APS supplies signed external evidence but cannot truthfully populate the required TRACE model, data_class, or build_provenance claims, so external-evidence-source with no conformance level is the honest classification. The documentation consistently separates signature validity, schema validity, and Level 0 coverage.
Local isolated validation:
- declared fixed environment remained at
agentrust-trace==0.10.0,agentrust-trace-tests==0.5.1, andagent-passport-system==3.0.1after installing the integration pytest integrations/aeoess-aps/tests -q: 29 passed- generated sample plus
trace-tests --level 0: 8 checks, 0 failures, exactlyTR-SIG-005unverified on the unsigned mapping - repository validation: 36 integrations, 0 failures; 17 focused validation/schema/catalog tests passed; compatibility and generated index/catalog checks passed
- clean merge simulation against current
mainatdc655071bd54ab6822fd373b72a84a86607f90e0
The failing maintainer gate is repository policy state, not an implementation defect. Approving.
|
Right, and further than the answer asked for. The fixed job checking installed versions against Two things checked rather than read: the Our fault, fixed in #179. The template presented One tightening for later, not a blocker: "cannot be re-observed at 0.10.0" is the stronger statement than it sounds. Merging. |
…e level (#179) The template showed `trace_conformance_level` and `trace_roles` as a pair and listed external-evidence-source as one of the role options, so a contributor following it pairs the two. That is how aeoess-aps came to carry `trace_conformance_level: 0` for a mapper that issues no Trust Record of its own (#170, corrected by #178). The schema already required a level of anyone claiming record-producer or record-consumer. It did not forbid one from an integration claiming neither, so nothing caught the pairing. The mirror rule is now expressed: when trace_roles is present and contains neither producer nor consumer, trace_conformance_level must be absent. The template says the same thing in prose, and now says it the way the WCM half of the same file already did: roles say what you do, and a role that verifies or issues nothing of its own declares no level. Verified against all 36 integrations, which all already comply: nobulex and computeid-agentpassport-trace carry external-evidence-source with no level, and every producer or consumer carries one. Checked in both directions, including that a record-producer with no level is still refused and that an integration holding both roles keeps its level. Claude-Session: https://claude.ai/code/session_01X27MBo6tGVw1UmmchuGFnW Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
3 participants
Closes #170. Follows the pinning boundary established in #169.
This corrects the APS role to
external-evidence-sourceand drops the record-conformance claim that came with the old role. Arecord-producerclaims to emit TRACE Trust Records, so a conformance level applies to it. APS provides signed external evidence that is mapped into TRACE record shape, so no TRACE record conformance level applies here. Level 0 was misleading in the other direction: it made APS look like a deficient record producer rather than a different kind of source.It also separates the two CI questions:
tested_against(it pins the complete package set needed to reproduce that result;integration.yamlrecords only the package keys its schema supports)The documentation, module docstrings, example and test names now treat Level 0 as a coverage result, not record verification. Under
agentrust-trace0.10.0,verify_recordcorrectly refuses the mapping output because APS cannot truthfully populatemodel,data_classorbuild_provenance. The 0.9.0 revocation observations in the README are kept as 0.9.0 results, since the schema refusal at 0.10.0 precedes the revocation check.No schema change is proposed.