fix(schema): an external-evidence-source declares no TRACE conformance level

integrations/_template/integration.yaml

@@ -16,10 +16,15 @@ marketplace:
   mark: EX                   # 1-3 letters/numbers shown when no logo is available
 # featured is maintainer-curated; do not add it to new submissions
 # keywords: [framework, use-case]
-# Required if you emit or consume TRACE records:
-# trace_conformance_level: 1
+# Required if you emit or consume TRACE records. Roles say what you do; the level
+# says which `trace-tests` level your own records reach. An external-evidence-source
+# maps somebody else's signed evidence into TRACE shape and issues no Trust Record of
+# its own, so it declares no level. See integrations/nobulex and
+# integrations/aeoess-aps.
 # trace_roles:
 #   - record-producer  # or record-consumer / external-evidence-source
+# Only for record-producer and record-consumer:
+# trace_conformance_level: 1
 # Required if you integrate with WCM. Roles say what you do; levels say which
 # `wcm conformance` layers you pass. attestation-source and evidence-consumer
 # verify no manifest and therefore declare no level.

schema/integration.schema.json

@@ -177,6 +177,20 @@
       },
       "then": { "required": ["trace_conformance_level"] }
     },
+    {
+      "$comment": "The mirror of the rule above. An external-evidence-source maps somebody else's signed evidence into TRACE shape and issues no Trust Record of its own, so it has no level of its own to claim. integrations/_template/integration.yaml previously showed the two as a pair, which is how aeoess-aps came to carry a level it could not support (integrations#170).",
+      "if": {
+        "required": ["trace_roles"],
+        "not": {
+          "properties": {
+            "trace_roles": {
+              "contains": { "enum": ["record-producer", "record-consumer"] }
+            }
+          }
+        }
+      },
+      "then": { "not": { "required": ["trace_conformance_level"] } }
+    },
     {
       "if": {
         "properties": {