From 5ac621c0587c223a7e6a0c5d51b13efef0c75ffe Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 12 Aug 2026 12:35:39 -0700 Subject: [PATCH 1/2] declare TRACE integration roles --- .github/workflows/validate.yml | 4 ++ claude-code/integration.yaml | 2 + integrations/_template/integration.yaml | 2 + integrations/aeoess-aps/integration.yaml | 2 + integrations/comply54/integration.yaml | 2 + integrations/decisionassure/integration.yaml | 3 + integrations/langchain/integration.yaml | 3 + integrations/llamaindex/integration.yaml | 3 + integrations/nobulex/integration.yaml | 2 + integrations/otel-genai/integration.yaml | 3 + integrations/ramen-ai-cmcp/integration.yaml | 2 + integrations/sage-agenttrust/integration.yaml | 2 + integrations/sentinel/integration.yaml | 2 + integrations/spendguard/integration.yaml | 2 + plugins/agentrust-codex/integration.yaml | 2 + scheduled-agents/integration.yaml | 2 + schema/integration.schema.json | 34 ++++++++++- tests/test_integration_schema.py | 61 +++++++++++++++++++ 18 files changed, 132 insertions(+), 1 deletion(-) create mode 100644 tests/test_integration_schema.py diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 032b64c..fa15bb9 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -41,3 +41,7 @@ jobs: print(f"{len(dirs)} integration(s), {failures} failure(s)") sys.exit(1 if failures else 0) PY + - name: Test conditional schema rules + run: | + pip install pytest + python -m pytest tests/test_integration_schema.py -q diff --git a/claude-code/integration.yaml b/claude-code/integration.yaml index 7c5866f..6e99a3f 100644 --- a/claude-code/integration.yaml +++ b/claude-code/integration.yaml @@ -10,6 +10,8 @@ repository: https://github.com/agentrust-io/integrations license: Apache-2.0 tier: community trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agent-manifest: 0.3.0 agentrust-trace: 0.5.0 diff --git a/integrations/_template/integration.yaml b/integrations/_template/integration.yaml index a76f7d4..0ae1bee 100644 --- a/integrations/_template/integration.yaml +++ b/integrations/_template/integration.yaml @@ -13,5 +13,7 @@ license: Apache-2.0 tier: community # set by maintainers during review; submissions start here # Required if you emit or consume TRACE records: # trace_conformance_level: 1 +# trace_roles: +# - record-producer # or record-consumer / external-evidence-source tested_against: cmcp-runtime: "0.2.0" diff --git a/integrations/aeoess-aps/integration.yaml b/integrations/aeoess-aps/integration.yaml index 0d1fb21..a2e8189 100644 --- a/integrations/aeoess-aps/integration.yaml +++ b/integrations/aeoess-aps/integration.yaml @@ -16,5 +16,7 @@ tier: community # cryptographically verified. The signed form is written alongside it and # verifies via agentrust_trace.verify_record (see README). trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agentrust-trace: "0.5.1" diff --git a/integrations/comply54/integration.yaml b/integrations/comply54/integration.yaml index 0a0bb0f..4930b6a 100644 --- a/integrations/comply54/integration.yaml +++ b/integrations/comply54/integration.yaml @@ -13,5 +13,7 @@ homepage: https://comply54.io license: Apache-2.0 tier: community trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agentrust-trace: "0.5.0" diff --git a/integrations/decisionassure/integration.yaml b/integrations/decisionassure/integration.yaml index bdcde4a..fe8c51c 100644 --- a/integrations/decisionassure/integration.yaml +++ b/integrations/decisionassure/integration.yaml @@ -8,3 +8,6 @@ maintainer: repository: https://github.com/a1k7/DecisionAssure-Runtime-Governance license: MIT tier: community +trace_roles: + - record-producer +trace_conformance_level: 0 diff --git a/integrations/langchain/integration.yaml b/integrations/langchain/integration.yaml index b4027bf..5d264fb 100644 --- a/integrations/langchain/integration.yaml +++ b/integrations/langchain/integration.yaml @@ -8,3 +8,6 @@ maintainer: repository: https://github.com/agentrust-io/integrations license: Apache-2.0 tier: community +trace_roles: + - record-producer +trace_conformance_level: 0 diff --git a/integrations/llamaindex/integration.yaml b/integrations/llamaindex/integration.yaml index 878959c..5f3067c 100644 --- a/integrations/llamaindex/integration.yaml +++ b/integrations/llamaindex/integration.yaml @@ -8,3 +8,6 @@ maintainer: repository: https://github.com/agentrust-io/integrations license: Apache-2.0 tier: community +trace_roles: + - record-producer +trace_conformance_level: 0 diff --git a/integrations/nobulex/integration.yaml b/integrations/nobulex/integration.yaml index 3edb66a..95a5ef5 100644 --- a/integrations/nobulex/integration.yaml +++ b/integrations/nobulex/integration.yaml @@ -13,3 +13,5 @@ repository: https://github.com/arian-gogani/nobulex homepage: https://nobulex.com license: MIT tier: community +trace_roles: + - external-evidence-source diff --git a/integrations/otel-genai/integration.yaml b/integrations/otel-genai/integration.yaml index 53f373a..9f91e4e 100644 --- a/integrations/otel-genai/integration.yaml +++ b/integrations/otel-genai/integration.yaml @@ -8,3 +8,6 @@ maintainer: repository: https://github.com/agentrust-io/integrations license: Apache-2.0 tier: community +trace_roles: + - record-producer +trace_conformance_level: 0 diff --git a/integrations/ramen-ai-cmcp/integration.yaml b/integrations/ramen-ai-cmcp/integration.yaml index 47a1a9c..2d568e3 100644 --- a/integrations/ramen-ai-cmcp/integration.yaml +++ b/integrations/ramen-ai-cmcp/integration.yaml @@ -14,6 +14,8 @@ homepage: https://ramenai.dev license: MIT tier: community trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agentrust-trace: "0.5.1" agentrust-trace-tests: "0.4.1" diff --git a/integrations/sage-agenttrust/integration.yaml b/integrations/sage-agenttrust/integration.yaml index 7abc8dd..ccb9e96 100644 --- a/integrations/sage-agenttrust/integration.yaml +++ b/integrations/sage-agenttrust/integration.yaml @@ -17,6 +17,8 @@ tier: community # Level the cMCP-RuntimeClaim (envelope) path passes; the bare C-2 TRACE record is not graded # by agentrust-trace-tests (LoadError), so it carries no conformance level — see README. trace_conformance_level: 0 +trace_roles: + - record-consumer tested_against: cmcp-runtime: "0.2.1" agentrust-trace: "0.5.0" diff --git a/integrations/sentinel/integration.yaml b/integrations/sentinel/integration.yaml index 6f08554..09d3802 100644 --- a/integrations/sentinel/integration.yaml +++ b/integrations/sentinel/integration.yaml @@ -10,3 +10,5 @@ repository: https://github.com/agentrust-io/integrations/tree/main/integrations/ license: MIT tier: community trace_conformance_level: 0 +trace_roles: + - record-producer diff --git a/integrations/spendguard/integration.yaml b/integrations/spendguard/integration.yaml index 92846bf..7989aa8 100644 --- a/integrations/spendguard/integration.yaml +++ b/integrations/spendguard/integration.yaml @@ -13,5 +13,7 @@ tier: community # Level 0 passes with the explicit TR-SIG-005 UNVERIFIED finding: trace-tests # 0.1.0 does not grade signatures on plain trace records (see README). trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agentrust-trace: "0.5.0" diff --git a/plugins/agentrust-codex/integration.yaml b/plugins/agentrust-codex/integration.yaml index f60a1a0..26fe525 100644 --- a/plugins/agentrust-codex/integration.yaml +++ b/plugins/agentrust-codex/integration.yaml @@ -10,6 +10,8 @@ repository: https://github.com/agentrust-io/integrations license: Apache-2.0 tier: community trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agent-manifest: 0.3.0 agentrust-trace: 0.5.0 diff --git a/scheduled-agents/integration.yaml b/scheduled-agents/integration.yaml index b271b18..d63ea03 100644 --- a/scheduled-agents/integration.yaml +++ b/scheduled-agents/integration.yaml @@ -9,6 +9,8 @@ repository: https://github.com/agentrust-io/integrations license: Apache-2.0 tier: community trace_conformance_level: 0 +trace_roles: + - record-producer tested_against: agentrust-trace: 0.5.0 agentrust-trace-tests: 0.4.0 diff --git a/schema/integration.schema.json b/schema/integration.schema.json index 782a5e9..86487a3 100644 --- a/schema/integration.schema.json +++ b/schema/integration.schema.json @@ -76,6 +76,16 @@ "maximum": 2, "description": "Required if the integration emits or consumes TRACE records: the agentrust-trace-tests level it passes." }, + "trace_roles": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "enum": ["record-producer", "record-consumer", "external-evidence-source"] + }, + "description": "How the integration relates to TRACE. Evidence sources do not claim to emit or verify TRACE records." + }, "tested_against": { "type": "object", "additionalProperties": false, @@ -87,5 +97,27 @@ }, "description": "Released package versions the integration was last tested against." } - } + }, + "allOf": [ + { + "if": { + "properties": { + "integrates_with": { "contains": { "const": "trace" } } + }, + "required": ["integrates_with"] + }, + "then": { "required": ["trace_roles"] } + }, + { + "if": { + "properties": { + "trace_roles": { + "contains": { "enum": ["record-producer", "record-consumer"] } + } + }, + "required": ["trace_roles"] + }, + "then": { "required": ["trace_conformance_level"] } + } + ] } diff --git a/tests/test_integration_schema.py b/tests/test_integration_schema.py new file mode 100644 index 0000000..c280dcb --- /dev/null +++ b/tests/test_integration_schema.py @@ -0,0 +1,61 @@ +from __future__ import annotations + +import json +from pathlib import Path + +import jsonschema + + +SCHEMA = json.loads( + (Path(__file__).parents[1] / "schema" / "integration.schema.json").read_text(encoding="utf-8") +) + + +def manifest(**overrides: object) -> dict[str, object]: + value: dict[str, object] = { + "name": "Example", + "vendor": "Example", + "integrates_with": ["cmcp"], + "description": "A technically testable integration.", + "maintainer": {"github": "example"}, + "repository": "https://example.com/repository", + "license": "Apache-2.0", + "tier": "community", + } + value.update(overrides) + return value + + +def validate(value: dict[str, object]) -> None: + jsonschema.validate(value, SCHEMA) + + +def test_trace_integration_declares_its_role() -> None: + value = manifest(integrates_with=["trace"]) + + try: + validate(value) + except jsonschema.ValidationError as exc: + assert "trace_roles" in exc.message + else: + raise AssertionError("TRACE integration without trace_roles was accepted") + + +def test_record_producer_declares_conformance_level() -> None: + value = manifest(integrates_with=["trace"], trace_roles=["record-producer"]) + + try: + validate(value) + except jsonschema.ValidationError as exc: + assert "trace_conformance_level" in exc.message + else: + raise AssertionError("TRACE producer without a conformance level was accepted") + + +def test_external_evidence_source_does_not_claim_record_conformance() -> None: + validate( + manifest( + integrates_with=["trace"], + trace_roles=["external-evidence-source"], + ) + ) From 102f02a27fff0960e84f0db9bd7bc018e2bde988 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 12 Aug 2026 14:55:28 -0700 Subject: [PATCH 2/2] style: restore trailing newline in validate.yml --- .github/workflows/validate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index c7ff55e..a4c9a58 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -29,4 +29,4 @@ jobs: - name: Test conditional schema rules run: | pip install pytest - python -m pytest tests/test_integration_schema.py -q \ No newline at end of file + python -m pytest tests/test_integration_schema.py -q