Schema Reference¶

JSON Schema for the TRACE v0.2 Trust Record. Source: schema/trace-claim.json.

Every field typed integer here is bounded to -9007199254740991 through 9007199254740991, and no field is typed number. That is not a size limit on the data; it is what spec section 3.2.2 can canonicalize unambiguously, since RFC 8785 serializes numbers through an IEEE 754 double and two integers outside that range can share one. A value that needs to be larger is carried as a string. The same bound applies to members a cnf.jwk carries that this schema does not name.

Top-level fields¶

model¶

Binds the model artifact used in this session.

runtime¶

Binds the execution environment. Platform-specific fields vary by TEE type.

policy¶

Binds the governance policy in force during this session.

data_class¶

String. Sensitivity classification applied to the data processed in this session.

Defined values: public, internal, confidential, restricted, secret.

Custom values are allowed and should follow your organization's data classification policy.

tool_transcript¶

Audit summary of tool invocations during the session.

delegation¶

A2A profile. Present when this execution acted on authority delegated by another agent; absent on a root (non-delegated) execution. A chain of records linked this way forms an offline-verifiable delegation DAG: a verifier walks parent_record_hash from a leaf record back to the root and confirms each hop acted under a credential in the delegation chain.

origin¶

Absent means the runtime produced its own record, which is what every hardware profile is and what a consumer assumes. Present means something else assembled the record from evidence it did not itself measure.

It exists because runtime.platform: "software-only" is ambiguous on its own: it is the honest value for a dev-mode record, where nothing attested the execution, and for a record transcribed from another vendor's control plane, where the party asserting the evidence also wrote the log.

A record whose kind is not self must carry runtime.platform: "software-only". An importer holding someone else's log has no quote to present, so a hardware platform on such a record is untrue rather than stronger. Both the reference model and schema/trace-claim.json reject the combination.

references¶

An array of pointers to facts held outside this record: an authorization decided before execution, a human approval, a behavioural trace. What the signature attests is that this record points there, not the truth of what it points at.

origin records where evidence came from and can lower assurance. references records what a record points at and cannot. Before the block existed, a record that needed to name something external had to use origin and take runtime.platform: "software-only" with it, which said something untrue about how the evidence was obtained.

rel is open where origin.kind is closed. Section 3.1.1 says kind is a closed set "because the value of the field is that a verifier can key on it"; section 3.1.2 calls rel's values a registry and does not say that, so a new relation is a spec change and not also a schema change.

Spec section 3.1.2 also binds verifiers: one must not reject a record because an entry cannot be resolved, and must not treat a resolved entry as attested evidence. A reference that could invalidate a record would hand whoever controls the target a way to invalidate evidence they do not hold. Both are verifier behaviour, so neither the schema nor the reference model can enforce them; they are conformance-suite rules. What the schema and the model do enforce is the shape, and that a producer who cannot name a resolver cannot emit an empty one.

build_provenance¶

Build-time provenance binding the deployed artifact.

appraisal¶

Verifier judgment on the evidence in this record.

transparency¶

String. URI of the SCITT transparency log entry anchoring this record. Omitted, or null, when the record is not anchored at issuance: anchoring may happen asynchronously. Never an empty string: the reference model rejects one (min_length=1).

cnf¶

Confirmation method. Contains the signing key bound to this record.

For TEE-issued records, this key was generated inside the measured enclave and its private half never leaves it. The hardware measurement in runtime cryptographically binds this key to the TEE.

Wire formats¶

TRACE v0.2 supports two wire formats:

JSON (primary): signed JSON object with signature as a top-level field.

CBOR-COSE (constrained devices): COSE_Sign1 structure with TRACE claims as the payload. Defined in §3.2 of the spec: deferred to a future profile for constrained-device deployments.

Example: AMD SEV-SNP¶

{
  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
  "iat": 1750676142,
  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
  "model": {
    "provider": "example-provider",
    "model_id": "example-model-1",
    "version": "20251001"
  },
  "runtime": {
    "platform": "amd-sev-snp",
    "measurement": "sha384:c9e4b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6...",
    "rim_uri": "https://kdsintf.amd.com/vcek/v1/Milan/cert_chain",
    "firmware_version": "1.53.0"
  },
  "policy": {
    "bundle_hash": "sha256:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1...",
    "enforcement_mode": "enforce",
    "version": "1.2.0"
  },
  "data_class": "confidential",
  "tool_transcript": {
    "hash": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3...",
    "call_count": 3
  },
  "build_provenance": {
    "slsa_level": 2,
    "builder": "https://github.com/slsa-framework/slsa-github-generator/...",
    "digest": "sha256:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4..."
  },
  "appraisal": {
    "status": "affirming",
    "verifier": "https://trust-authority.example.org"
  },
  "transparency": "https://registry.agentrust-io.com/claim/trace-2026-06-23T09:15:42Z",
  "cnf": {
    "jwk": { "kty": "EC", "crv": "P-256", "x": "...", "y": "..." }
  },
  "signature": "base64url..."
}

See the full example files in examples/.