{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://agentrust-io.com/schema/trace-claim-v0.3-draft.json", "$defs": { "canonicalizableValue": { "description": "Any JSON value section 3.2.2 can canonicalize without ambiguity. RFC 7517 lets a JWK carry members this schema does not name, those members are covered by the signature, and they therefore need the constraint the named fields carry: `number` is excluded, and an integer is held to the safe-integer domain. Recursive, because such a member may itself be an array or an object.", "anyOf": [ { "type": [ "string", "boolean", "null" ] }, { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, { "type": "array", "items": { "$ref": "#/$defs/canonicalizableValue" } }, { "type": "object", "additionalProperties": { "$ref": "#/$defs/canonicalizableValue" } } ] } }, "title": "TRACE Trust Record (v0.3 runtime-evidence draft)", "description": "DRAFT. v0.3 profile boundary plus runtime.evidence. Binds nothing until docs/rfcs/runtime-evidence-profile.md is adopted. Outside the profile identifier and runtime.evidence, members are byte-identical to schema/trace-claim.json so the diff is reviewable.", "type": "object", "required": [ "eat_profile", "iat", "subject", "model", "runtime", "policy", "data_class", "build_provenance", "appraisal", "cnf" ], "properties": { "eat_profile": { "type": "string", "const": "tag:agentrust-io.com,2026:trace-v0.3", "description": "EAT profile URI identifying this as a TRACE v0.3 runtime-evidence draft Trust Record." }, "iat": { "type": "integer", "description": "Issued-at time as Unix epoch seconds.", "minimum": 1700000000, "maximum": 9007199254740991 }, "subject": { "type": "string", "description": "Workload identity as a SPIFFE SVID URI or DID URI. A SPIFFE ID carries a trust domain and a workload path within it; a DID carries a lowercase method name, per DID Core section 3.1, and a method-specific identifier. A prefix alone is not an identity: spiffe://example.org names a trust domain and no workload.", "pattern": "^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$" }, "model": { "type": "object", "description": "Model identity and provenance.", "required": [ "provider", "model_id" ], "properties": { "provider": { "type": "string", "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')." }, "model_id": { "type": "string", "description": "Model identifier as used by the provider." }, "version": { "type": "string", "description": "Model version or snapshot identifier." }, "weights_digest": { "type": "string", "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" }, "aibom_uri": { "type": "string", "format": "uri", "description": "URI to SPDX 3.0 AI Profile or CycloneDX 1.7 ML-BOM for this model." } }, "additionalProperties": false }, "runtime": { "type": "object", "description": "TEE measurement chain binding the workload to hardware.", "required": [ "platform", "measurement" ], "properties": { "platform": { "type": "string", "enum": [ "intel-tdx", "amd-sev-snp", "azure-cvm-sev-snp", "nvidia-h100", "nvidia-blackwell", "aws-nitro", "arm-cca", "google-confidential-space", "tpm2", "software-only" ], "description": "Hardware platform providing the root of trust. software-only marks records with no hardware root of trust, for example a development-mode execution, or a record assembled from evidence produced outside the runtime (origin.kind other than self requires this value; see spec 3.1.1). Such records must never be treated as attested evidence." }, "measurement": { "type": "string", "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" }, "rim_uri": { "type": "string", "format": "uri", "description": "URI to the vendor-published Reference Integrity Manifest for this measurement." }, "nonce": { "type": "string", "description": "Freshness nonce binding the attestation report to this record (base64url, no padding)." }, "firmware_version": { "type": "string", "description": "Firmware or microcode version included in the measurement." }, "evidence": { "type": "object", "description": "The attestation evidence itself, so a verifier can check runtime.measurement rather than take it. Absent means the record asserts its runtime claims without offering anything to verify them against, which is what every v0.2 record does.", "required": [ "format" ], "properties": { "format": { "type": "string", "enum": [ "tdx-quote-v4", "sev-snp-report-v2", "tpm2-quote", "nvidia-gpu-attestation-report" ], "description": "Wire format of the evidence, which selects the verifier and the rule for extracting the measurement to compare." }, "quote": { "type": "string", "pattern": "^[A-Za-z0-9_-]+$", "description": "Attestation evidence bytes supplied by the producer, base64url, no padding. Preserving the platform-emitted declared structure is a producer obligation, not a property a verifier can establish from this record alone. A verifier evaluates the format-defined structure and does not treat trailing bytes as evidence for or against a grade." }, "quote_digest": { "type": "string", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", "description": "Digest of the evidence, for the by-reference form." }, "quote_uri": { "type": "string", "format": "uri", "description": "Where the evidence may be fetched, for the by-reference form." }, "collateral": { "type": "string", "enum": [ "embedded", "required" ], "description": "embedded: everything needed to verify travels in the quote. required: the verifier must supply collateral out of band, so offline verification is not possible from this record alone." }, "collateral_uri": { "type": "string", "format": "uri", "description": "Where that collateral may be fetched when collateral is required." }, "binds": { "type": "string", "enum": [ "cnf-key", "weights-digest", "manifest-digest", "nonce", "unspecified" ], "description": "What the guest committed to in the platform's guest-controlled field. A claim about the binding, not proof of it: a verifier recomputes and does not read this to decide. unspecified is the honest value when the producer does not know." } }, "oneOf": [ { "required": [ "quote" ] }, { "required": [ "quote_digest" ] } ], "additionalProperties": false } }, "additionalProperties": false }, "policy": { "type": "object", "description": "Policy bundle sealed to the TEE measurement.", "required": [ "bundle_hash", "enforcement_mode" ], "properties": { "bundle_hash": { "type": "string", "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" }, "enforcement_mode": { "type": "string", "enum": [ "enforce", "advisory", "silent", "declared" ], "default": "enforce", "description": "How the policy named by bundle_hash related to this execution. enforce: evaluated and blocked on deny. advisory: evaluated, logged, allowed. silent: evaluated and enforced with operational logs suppressed; the audit chain still records every would-have-denied decision. declared: the policy is named and bound into the signed record and NOTHING evaluated it, which is the honest value for a producer with no policy engine, such as an agent framework. Gateways MUST default to enforce. A deployment MUST explicitly configure silent. declared is never a default, a producer that evaluates policy MUST NOT use it, and a consumer MUST NOT read it as evidence that any rule was checked." }, "version": { "type": "string", "description": "Policy bundle version (semantic versioning recommended)." }, "policy_uri": { "type": "string", "format": "uri", "description": "URI to the policy bundle for verification." } }, "additionalProperties": false }, "data_class": { "type": "string", "description": "Highest-sensitivity data classification of inputs and outputs processed during this execution.", "examples": [ "public", "internal", "confidential", "restricted", "top-secret" ] }, "tool_transcript": { "type": "object", "description": "Bound hash of the MCP/A2A tool-call transcript. OPTIONAL for Phase 1 records; REQUIRED for Phase 2+.", "required": [ "hash" ], "properties": { "hash": { "type": "string", "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" }, "call_count": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "Total number of tool calls in this session." }, "transcript_uri": { "type": "string", "format": "uri", "description": "URI to the full transcript on the transparency log." } }, "additionalProperties": false }, "delegation": { "type": "object", "description": "A2A profile: links this record to the delegating hop's Trust Record. Present when this execution acted on delegated authority; absent on a root (non-delegated) execution. A chain of these forms an offline-verifiable delegation DAG.", "required": [ "parent_record_hash", "credential_id" ], "properties": { "parent_record_hash": { "type": "string", "description": "SHA-256 or SHA-384 digest of the parent hop's Trust Record.", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" }, "credential_id": { "type": "string", "minLength": 1, "description": "Identifier of the delegation credential this hop acted under." } }, "additionalProperties": false }, "origin": { "type": "object", "description": "Where the evidence in this record came from, when that is not this runtime. Absent means the runtime produced its own record, which is what a consumer assumes and what every hardware profile is. Present means something else assembled the record from evidence it did not measure. A non-self kind cannot carry a hardware runtime.platform.", "required": [ "kind", "producer" ], "properties": { "kind": { "type": "string", "enum": [ "self", "third-party-control-plane", "log-import" ], "description": "self: the runtime produced its own record. third-party-control-plane: assembled from another vendor's runtime governance output, asserted by the system that produced it with no root outside that system. log-import: assembled from a log or export whose producer is not a control plane." }, "producer": { "type": "string", "minLength": 1, "description": "Identifier of the system that produced the source evidence." }, "source_event_id": { "type": "string", "minLength": 1, "description": "Identifier of the source event in the producing system, so a record can be traced back to it." }, "ingested_at": { "type": "integer", "minimum": 1700000000, "maximum": 9007199254740991, "description": "Unix time at which the source evidence was ingested. Distinct from iat, which is when this record was issued." } }, "additionalProperties": false }, "references": { "type": "array", "description": "Facts outside this record that it points at. Spec section 3.1.2. An entry is a pointer, not evidence: the signature attests that this record points there, not the truth of what it points at. The block is assurance-neutral and does not affect runtime.platform. Two further rules in 3.1.2 bind verifiers rather than records, so this schema cannot express them: a verifier MUST NOT reject a record because an entry cannot be resolved, and MUST NOT treat a resolved entry as attested evidence.", "items": { "type": "object", "required": [ "rel", "id", "resolver" ], "properties": { "rel": { "type": "string", "minLength": 1, "description": "Relationship type. The registered values are a registry that grows, so this is not a closed set. authorized-intent: an authorization decided before execution, held in another system. approval-outcome: an attributable human approval attached to a step-up or defer decision. behavior-trace: a behavioural record of what the agent did, of which this record is the environment evidence." }, "id": { "type": "string", "minLength": 1, "description": "Identifier of the referenced fact within the resolver's system." }, "resolver": { "type": "string", "minLength": 1, "description": "Identifier of the party obliged to resolve id. A producer that cannot name one omits the entry. Which identifiers are self-asserted is not decidable from the record, so this constrains the field's presence and not its value." }, "retention": { "type": "string", "pattern": "^P(\\d+W|(\\d+Y(\\d+M)?(\\d+D)?|\\d+M(\\d+D)?|\\d+D)(T(\\d+H(\\d+M)?(\\d+S)?|\\d+M(\\d+S)?|\\d+S))?|T(\\d+H(\\d+M)?(\\d+S)?|\\d+M(\\d+S)?|\\d+S))$", "description": "Period for which resolver undertakes to keep id resolvable, as an ISO 8601 duration. An undertaking only: nothing in this specification enforces it." }, "digest": { "type": "string", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$", "description": "SHA-256 or SHA-384 digest of the referenced object, when the producer holds it at issue time." } }, "additionalProperties": false } }, "build_provenance": { "type": "object", "description": "SLSA provenance for the workload (agent code + container image).", "required": [ "slsa_level", "digest" ], "properties": { "slsa_level": { "type": "integer", "minimum": 0, "maximum": 3, "description": "SLSA Build Level achieved. Level 0 = software-only (development/staging); Level 2 minimum for TRACE conformance; Level 3 for production mark." }, "builder": { "type": "string", "description": "SLSA builder URI." }, "digest": { "type": "string", "description": "SHA-256 or SHA-384 digest of the container image or workload binary.", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$" }, "provenance_uri": { "type": "string", "format": "uri", "description": "URI to the SLSA provenance attestation on a Sigstore/Rekor or compatible log." }, "provenance_depth": { "type": "string", "enum": [ "surface", "builder", "transitive" ], "description": "Depth of supply-chain verification the issuer claims for this record. surface: digest matches the workload artifact and builder is in a trusted set. builder: all of surface, plus provenance_uri resolves, the SLSA attestation signature verifies, its subject matches digest, and its builder.id matches builder. transitive: all of builder, plus every entry in the SLSA materials / resolvedDependencies has a verifiable publisher attestation. Records omitting this field are treated as surface by verifiers, so existing records keep their meaning." } }, "additionalProperties": false }, "appraisal": { "type": "object", "description": "Verifier's EAR appraisal of the evidence (draft-ietf-rats-ar4si).", "required": [ "status", "verifier" ], "properties": { "status": { "type": "string", "enum": [ "affirming", "warning", "contraindicated", "none" ], "description": "EAR appraisal status." }, "verifier": { "type": "string", "format": "uri", "description": "URI identifying the verifier that produced this appraisal." }, "policy_ref": { "type": "string", "format": "uri", "description": "URI to the appraisal policy used." }, "timestamp": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991, "description": "Unix epoch seconds when the appraisal was produced." }, "provenance_depth_verified": { "type": "string", "enum": [ "surface", "builder", "transitive" ], "description": "Depth at which this verifier actually checked build_provenance, which is not necessarily the depth the issuer claimed. A verifier may downgrade when deeper evidence does not resolve, and records the lower depth rather than a failure of the higher one. A verifier does not record a depth higher than it executed." } }, "additionalProperties": false }, "transparency": { "type": "string", "format": "uri", "description": "SCITT receipt URI. The Trust Record is the Signed Statement; this URI resolves to the inclusion proof (Receipt) on the transparency log." }, "cnf": { "type": "object", "description": "Confirmation key (RFC 8747) that binds the Trust Record to the TEE-held signing key.", "required": [ "jwk" ], "properties": { "jwk": { "type": "object", "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y.", "required": [ "kty" ], "properties": { "kty": { "type": "string" }, "crv": { "type": "string" }, "x": { "type": "string" }, "y": { "type": "string" }, "kid": { "type": "string" } }, "allOf": [ { "if": { "required": [ "kty" ], "properties": { "kty": { "const": "OKP" } } }, "then": { "required": [ "crv", "x" ] } }, { "if": { "required": [ "kty" ], "properties": { "kty": { "const": "EC" } } }, "then": { "required": [ "crv", "x", "y" ] } } ], "additionalProperties": { "$ref": "#/$defs/canonicalizableValue" } } }, "additionalProperties": false }, "signature": { "type": "string", "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with only this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.", "pattern": "^[A-Za-z0-9_-]+$" } }, "additionalProperties": false, "allOf": [ { "$comment": "A record assembled from another party's evidence has no hardware root. Mirrors the cross-field check in the reference model, so a validator that only reads this schema enforces it too.", "if": { "required": [ "origin" ], "properties": { "origin": { "required": [ "kind" ], "properties": { "kind": { "enum": [ "third-party-control-plane", "log-import" ] } } } } }, "then": { "properties": { "runtime": { "properties": { "platform": { "const": "software-only" } } } } } } ] }