test: add action receipt conformance fixtures - #101
Conversation
Signed-off-by: Carlos Hernandez-Vaquero <carloshvp@gmail.com>
imran-siddique
left a comment
There was a problem hiding this comment.
Approving. Reviewed the diff: 9 action-receipt conformance fixtures plus tests/test_action_receipt_fixtures.py, all under examples/ and tests/. This is non-normative test material, so the spec policy on individual-authored normative changes does not apply.
The fixtures are well formed and cover the right cases: valid accepted/rejected, missing required receipt, signature and action-ref mismatch, stale receipt, chain gap, same-party self-report, and unsupported physical completion. The test recomputes each digest and verifies signatures, session/call binding, freshness, and receipt-chain order, with no network or ROS dependency. The pinned JWKs are labeled public test material with a use-your-own-keys note. CI is green. Solid conformance set.
…ut the statuses Corrects this file. An earlier revision said the vectors sat in the wrong place because agentrust-io#116 and agentrust-io#117 both name trace-tests. Checking trace-tests settled it the other way. trace-tests is a certification suite, run against an implementation with `trace-tests verify --record ... --level 1`. Its vectors are whole Trust Records and its seven modules map to normative spec sections; it carries no action-receipt module at all. Upstream already placed action-receipt conformance fixtures in trace-spec, in agentrust-io#101, by a different contributor, which is the established practice whatever the issue text says. And §3.3.2 marks action receipts informative: a certification suite cannot test a requirement that is not normative yet. So trace-spec is the right home while the mechanism is a proposal, and the move to trace-tests is gated on normative text landing rather than pending now. Both open decisions are marked accepted, with the delegation recorded. The Level 0 boundary is not really a choice - GitHub-hosted runners are not a TEE and LIMITATIONS.md already limits Level 0 to development use, so declining it would be choosing to overstate. It binds how this project's own releases are described everywhere, not only here; reversing it means appending a superseding entry. Also corrects a stale count in the verification record: 195 tests across the full 3.11 to 3.14 matrix, not 152 across three versions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
What this changes
Refs #95. Builds on #66 and agentrust-io/cmcp#392.
Adds nine signed action-receipt conformance fixtures for:
action_refmismatches;The fixture contract uses RFC 8785 JCS for
action_ref, detached evidence hashing, and the Ed25519 receipt signature preimage. Each case pins the trusted issuer key outside the receipt and carries machine-readable expected results.tests/test_action_receipt_fixtures.pyrecomputes the hashes, verifies signatures, checks call/session binding, enforces freshness and receipt ordering, and compares each result with the fixture expectation.The fixtures are static. They add no ROS runtime dependency and do not change the TRACE schema, library API, or normative spec text.
Type of change
Spec section
Informative examples for
spec/trace-v0.1.mdsection 3.3.2, "Action receipts for embodied workflows."Validation
uv run --extra dev ruff check src/ tests/uv run --extra dev pytest -q(89 passed)uv run --extra dev mypy src/agentrust_tracegit diff --checkBackward compatibility
No schema, API, or normative verification behavior changes.
Checklist
git commit -s)CHANGELOG.mdupdated (not applicable; no normative change)