Skip to content

index.md

Latest commit

 

History

History
74 lines (43 loc) · 3.59 KB

index.md

File metadata and controls

74 lines (43 loc) · 3.59 KB
Raw
title Create and verify signed runtime evidence
description TRACE defines portable signed runtime evidence. Start with software signing and tamper detection, then explore hardware attestation and transparency verification.

Sign a runtime record. Check its evidence.

TRACE is an open specification for portable, signed runtime evidence. Its record format connects workload identity, policy, data classification, and tool-transcript commitments. A verifier checks the signature and the evidence required by its trust policy.

Create and verify your first record{ .md-button .md-button--primary } Understand the trust levels{ .md-button }

The first example needs Python 3.11+ and no cloud account. It signs synthetic declarations in software, verifies with a separately retained key, and demonstrates tamper detection. Hardware provenance and registry inclusion require additional evidence and checks.

What the record contains

Question Fields to inspect What the verifier still needs
Which workload is named? subject, model An authenticated issuer and evidence binding the workload
What runtime is claimed? runtime Valid attestation and approved measurements for hardware provenance
Which policy is named? policy Independently approved policy inputs
What data class is declared? data_class Evidence supporting the producer's classification
What transcript is committed? tool_transcript Transcript evidence when individual calls matter
Was evidence anchored? transparency A verified receipt and the required log trust policy

A signed field is a producer's claim. Signature verification alone does not establish that the described execution occurred or that a policy was enforced. See the verification protocol for the full evaluation path.

Where to start

  • Run it

    Sign a record, verify it, and see what a failed check looks like.

    Quickstart

  • Read it

    The normative specification, with the claim set, the anchoring protocol, and the verification rules.

    TRACE v0.2

  • Test it

    Score an implementation against the spec by conformance level before claiming compliance.

    Conformance suite

  • Integrate it

    Emit and consume Trust Records from AGT, cMCP, and sandboxed agent runtimes.

    Integration guides

What it is built on

TRACE profiles existing IETF and IRTF work rather than replacing it: RFC 9711 (EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring. A related standardization track runs in CoSAI WS4.

Status and governance

The specification is a Developer Preview. v0.2 is current and published with a conformance test suite. Read Limitations for the scope boundaries before relying on it in production.

TRACE Specification is an LF Project, hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC", under LF Projects policies. See Governance for how decisions are made and Contributing for how to propose a change.