feat(provenance): bind delegation DAG to signed TRACE records#54
Merged
Conversation
imran-siddique
force-pushed
the
feat/dag-trace-binding
branch
from
July 20, 2026 15:34
b7ed3bc to
cfa88b6
Compare
Lift each cA2A delegation hop into a signed TRACE Trust Record carrying the A2A profile delegation block, so a chain of hops forms a delegation DAG that is verifiable with the standard TRACE tooling, not only cA2A's own verifier. - ca2a_runtime.trace_binding: build_trace_record, sign_trace_record, trace_record_hash, emit_dag, HopContext (with a .software() constructor for the software-attestation path). Records are produced and signed with agentrust-trace (Ed25519 over RFC 8785), reused rather than reimplemented. - ca2a_verify.verify_trace_dag: offline DAG verification (structural validity, trusted-key signatures, unbroken parent links) and cross_check_trace_dag to tie the DAG to the delegation chain. New error TRACE_RECORD_INVALID. - delegation.parent_record_hash commits to the parent's full signed record, so a re-signed or tampered parent breaks the child link. - examples/trace-dag: runnable demo (emit, verify offline, Level 0 conformance). Software-mode records are honestly TRACE Level 0 (platform software-only); an end-to-end run on confidential-computing hardware lifts them to Level 1. Adds the agentrust-trace runtime dependency (agentrust-trace-tests for dev). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
imran-siddique
force-pushed
the
feat/dag-trace-binding
branch
from
July 20, 2026 15:39
cfa88b6 to
88046d9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Binds cA2A's delegation DAG to the TRACE interchange format. Each delegation hop is lifted into a signed TRACE Trust Record carrying the A2A profile
delegationblock, so a chain of hops is verifiable with the standard TRACE tooling (agentrust-trace,trace-tests, the/tracereport), not only cA2A's own verifier. Closes the "Linked runtime evidence" item on the v0.2 roadmap.How
ca2a_runtime.trace_binding:build_trace_record,sign_trace_record,trace_record_hash,emit_dag, andHopContext(with a.software()constructor for the software-attestation path). Records are produced and signed withagentrust-trace(Ed25519 over RFC 8785 JCS), reused rather than reimplemented (ROADMAP Tier 0).ca2a_verify.verify_trace_dag: offline DAG verification (structural validity, trusted-key signatures, unbroken parent links) andcross_check_trace_dagto tie the DAG to the delegation chain. New errorTRACE_RECORD_INVALID.delegation.parent_record_hashcommits to the parent's full signed record, so a re-signed or tampered parent breaks the child link (tested).examples/trace-dag/: runnable demo (emit, verify offline, Level 0 conformance) + README.The
delegationblock already exists in the TRACE v0.1 schema, so no schema change was needed.Honesty on assurance
Software-mode records are TRACE Level 0 (platform
software-only;trace-testsfails software-only at Level 1 by design). Appraisal and transparency URIs use the reserved.invalidTLD so a software-mode record can never be mistaken for a hardware-attested one. An end-to-end run on confidential-computing hardware lifts records to Level 1.Verification
test_live_call.py, which lives on the transport branch).trace-testsCLI independently confirms PASS at Level 0, 8 checks on a record carrying the delegation block.Dependencies
Adds
agentrust-trace>=0.3,<0.4(runtime) andagentrust-trace-tests>=0.2,<0.3(dev). Cross-repo version skew is a known risk noted in LIMITATIONS.md.🤖 Generated with Claude Code