Declare TRACE integration roles and conformance claims

.github/workflows/validate.yml

@@ -26,3 +26,7 @@ jobs:
         run: |
           pip install pytest
           python -m pytest tests/test_validate_integrations.py -q
+      - name: Test conditional schema rules
+        run: |
+          pip install pytest
+          python -m pytest tests/test_integration_schema.py -q

claude-code/integration.yaml

@@ -10,6 +10,8 @@ repository: https://github.com/agentrust-io/integrations
 license: Apache-2.0
 tier: community
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agent-manifest: 0.3.0
   agentrust-trace: 0.5.0

integrations/_template/integration.yaml

@@ -13,5 +13,7 @@ license: Apache-2.0
 tier: community   # set by maintainers during review; submissions start here
 # Required if you emit or consume TRACE records:
 # trace_conformance_level: 1
+# trace_roles:
+#   - record-producer  # or record-consumer / external-evidence-source
 tested_against:
   cmcp-runtime: "0.2.0"

integrations/aeoess-aps/integration.yaml

@@ -16,5 +16,7 @@ tier: community
 # cryptographically verified. The signed form is written alongside it and
 # verifies via agentrust_trace.verify_record (see README).
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agentrust-trace: "0.5.1"

integrations/comply54/integration.yaml

@@ -13,5 +13,7 @@ homepage: https://comply54.io
 license: Apache-2.0
 tier: community
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agentrust-trace: "0.5.0"

integrations/decisionassure/integration.yaml

@@ -8,3 +8,6 @@ maintainer:
 repository: https://github.com/a1k7/DecisionAssure-Runtime-Governance
 license: MIT
 tier: community
+trace_roles:
+  - record-producer
+trace_conformance_level: 0

integrations/langchain/integration.yaml

@@ -8,3 +8,6 @@ maintainer:
 repository: https://github.com/agentrust-io/integrations
 license: Apache-2.0
 tier: community
+trace_roles:
+  - record-producer
+trace_conformance_level: 0

integrations/llamaindex/integration.yaml

@@ -8,3 +8,6 @@ maintainer:
 repository: https://github.com/agentrust-io/integrations
 license: Apache-2.0
 tier: community
+trace_roles:
+  - record-producer
+trace_conformance_level: 0

integrations/nobulex/integration.yaml

@@ -13,3 +13,5 @@ repository: https://github.com/arian-gogani/nobulex
 homepage: https://nobulex.com
 license: MIT
 tier: community
+trace_roles:
+  - external-evidence-source

integrations/otel-genai/integration.yaml

@@ -8,3 +8,6 @@ maintainer:
 repository: https://github.com/agentrust-io/integrations
 license: Apache-2.0
 tier: community
+trace_roles:
+  - record-producer
+trace_conformance_level: 0

integrations/ramen-ai-cmcp/integration.yaml

@@ -14,6 +14,8 @@ homepage: https://ramenai.dev
 license: MIT
 tier: community
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agentrust-trace: "0.5.1"
   agentrust-trace-tests: "0.4.1"

integrations/sage-agenttrust/integration.yaml

@@ -17,6 +17,8 @@ tier: community
 # Level the cMCP-RuntimeClaim (envelope) path passes; the bare C-2 TRACE record is not graded
 # by agentrust-trace-tests (LoadError), so it carries no conformance level — see README.
 trace_conformance_level: 0
+trace_roles:
+  - record-consumer
 tested_against:
   cmcp-runtime: "0.2.1"
   agentrust-trace: "0.5.0"

integrations/sentinel/integration.yaml

@@ -10,3 +10,5 @@ repository: https://github.com/agentrust-io/integrations/tree/main/integrations/
 license: MIT
 tier: community
 trace_conformance_level: 0
+trace_roles:
+  - record-producer

integrations/spendguard/integration.yaml

@@ -13,5 +13,7 @@ tier: community
 # Level 0 passes with the explicit TR-SIG-005 UNVERIFIED finding: trace-tests
 # 0.1.0 does not grade signatures on plain trace records (see README).
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agentrust-trace: "0.5.0"

plugins/agentrust-codex/integration.yaml

@@ -10,6 +10,8 @@ repository: https://github.com/agentrust-io/integrations
 license: Apache-2.0
 tier: community
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agent-manifest: 0.3.0
   agentrust-trace: 0.5.0

scheduled-agents/integration.yaml

@@ -9,6 +9,8 @@ repository: https://github.com/agentrust-io/integrations
 license: Apache-2.0
 tier: community
 trace_conformance_level: 0
+trace_roles:
+  - record-producer
 tested_against:
   agentrust-trace: 0.5.0
   agentrust-trace-tests: 0.4.0

schema/integration.schema.json

@@ -76,6 +76,16 @@
       "maximum": 2,
       "description": "Required if the integration emits or consumes TRACE records: the agentrust-trace-tests level it passes."
     },
+    "trace_roles": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": ["record-producer", "record-consumer", "external-evidence-source"]
+      },
+      "description": "How the integration relates to TRACE. Evidence sources do not claim to emit or verify TRACE records."
+    },
     "tested_against": {
       "type": "object",
       "additionalProperties": false,
@@ -87,5 +97,27 @@
       },
       "description": "Released package versions the integration was last tested against."
     }
-  }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "integrates_with": { "contains": { "const": "trace" } }
+        },
+        "required": ["integrates_with"]
+      },
+      "then": { "required": ["trace_roles"] }
+    },
+    {
+      "if": {
+        "properties": {
+          "trace_roles": {
+            "contains": { "enum": ["record-producer", "record-consumer"] }
+          }
+        },
+        "required": ["trace_roles"]
+      },
+      "then": { "required": ["trace_conformance_level"] }
+    }
+  ]
 }

tests/test_integration_schema.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import jsonschema
+
+
+SCHEMA = json.loads(
+    (Path(__file__).parents[1] / "schema" / "integration.schema.json").read_text(encoding="utf-8")
+)
+
+
+def manifest(**overrides: object) -> dict[str, object]:
+    value: dict[str, object] = {
+        "name": "Example",
+        "vendor": "Example",
+        "integrates_with": ["cmcp"],
+        "description": "A technically testable integration.",
+        "maintainer": {"github": "example"},
+        "repository": "https://example.com/repository",
+        "license": "Apache-2.0",
+        "tier": "community",
+    }
+    value.update(overrides)
+    return value
+
+
+def validate(value: dict[str, object]) -> None:
+    jsonschema.validate(value, SCHEMA)
+
+
+def test_trace_integration_declares_its_role() -> None:
+    value = manifest(integrates_with=["trace"])
+
+    try:
+        validate(value)
+    except jsonschema.ValidationError as exc:
+        assert "trace_roles" in exc.message
+    else:
+        raise AssertionError("TRACE integration without trace_roles was accepted")
+
+
+def test_record_producer_declares_conformance_level() -> None:
+    value = manifest(integrates_with=["trace"], trace_roles=["record-producer"])
+
+    try:
+        validate(value)
+    except jsonschema.ValidationError as exc:
+        assert "trace_conformance_level" in exc.message
+    else:
+        raise AssertionError("TRACE producer without a conformance level was accepted")
+
+
+def test_external_evidence_source_does_not_claim_record_conformance() -> None:
+    validate(
+        manifest(
+            integrates_with=["trace"],
+            trace_roles=["external-evidence-source"],
+        )
+    )