fix(schema): an external-evidence-source declares no TRACE conformance level - #179
Merged
imran-siddique merged 2 commits intoSep 12, 2026
Conversation
…e level The template showed `trace_conformance_level` and `trace_roles` as a pair and listed external-evidence-source as one of the role options, so a contributor following it pairs the two. That is how aeoess-aps came to carry `trace_conformance_level: 0` for a mapper that issues no Trust Record of its own (#170, corrected by #178). The schema already required a level of anyone claiming record-producer or record-consumer. It did not forbid one from an integration claiming neither, so nothing caught the pairing. The mirror rule is now expressed: when trace_roles is present and contains neither producer nor consumer, trace_conformance_level must be absent. The template says the same thing in prose, and now says it the way the WCM half of the same file already did: roles say what you do, and a role that verifies or issues nothing of its own declares no level. Verified against all 36 integrations, which all already comply: nobulex and computeid-agentpassport-trace carry external-evidence-source with no level, and every producer or consumer carries one. Checked in both directions, including that a record-producer with no level is still refused and that an integration holding both roles keeps its level. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X27MBo6tGVw1UmmchuGFnW
…-evidence-source-declares-no-level
imran-siddique
deleted the
fix/template-external-evidence-source-declares-no-level
branch
September 12, 2026 17:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
integrations/_template/integration.yamlpresentedtrace_conformance_levelandtrace_rolesas a pair and listedexternal-evidence-sourceamong the role options, so a contributor following the template pairs the two. That is howaeoess-apscame to carrytrace_conformance_level: 0for a mapper that issues no Trust Record of its own (#170, corrected by @aeoess in #178).The schema already required a level of anyone claiming
record-producerorrecord-consumer. It did not forbid one from an integration claiming neither, so nothing caught the pairing. This adds the mirror rule.Interesting detail: the WCM half of the same template already states the principle correctly, "attestation-source and evidence-consumer verify no manifest and therefore declare no level". The TRACE half was missing the same sentence.
Verified
All 36 integrations already comply, so this turns nothing red:
nobulexandcomputeid-agentpassport-tracecarryexternal-evidence-sourcewith no level, and every producer or consumer carries one.scripts/validate_integrations.pyreports 36 integrations, 0 failures.Checked in both directions against the committed
nobulexdocument:The last two controls are the ones that matter: the existing required-level rule still fires, and an integration holding both roles keeps its level, because the producer half earns it.
scripts/generate_integration_index.pyproduces no diff, so the README index is unaffected.🤖 Generated with Claude Code
https://claude.ai/code/session_01X27MBo6tGVw1UmmchuGFnW