Test Modules¶
The TRACE conformance suite is divided into eight modules. A module is a group of related checks on one part of a record, such as its signature or the hardware it says it ran on. Each module maps to a section of the TRACE specification, and each one's page lists every check with an example that passes and one that fails.
The table below uses the record's own field names (in code font). The conformance levels page says which modules run at which level.
| Module | ID Prefix | Spec Section | What It Tests |
|---|---|---|---|
| Envelope | TR-ENV | §3.2 | eat_profile URI, iat validity, subject form, presence of cnf.jwk.kty |
| Signature | TR-SIG | §3.2.1 | Private key leak detection, key type support, and the Ed25519 signature verification outcome |
| Runtime | TR-RTE | §3.1 | TEE platform enum, measurement format, RIM URI scheme, and verifier-issued nonce comparison |
| Policy | TR-POL | §3.1 | Policy bundle hash format, enforcement mode values, and whether the bundle at policy_uri has the declared digest |
| Appraisal | TR-APR | §3.1 | Appraisal status enum, verifier URI form, policy_ref URI form, and timestamp plausibility. The appraisal policy is never resolved |
| Transcript | TR-TXN | §3.1 | Tool-call transcript hash binding |
| Transparency | TR-ANC | §3.2 | SCITT receipt URI form (TR-ANC-001), and offline replay of the inclusion proof against the committed Merkle root when a receipt is supplied (TR-ANC-002). The URI itself is never resolved |
| Provenance | TR-SCA | §3.1 | SLSA provenance level and digest format |