TRACE Conformance Test Suite
Verify your TRACE implementation before shipping
Quick Start | Test Modules | Conformance Levels | Changelog
Test suite v0.2. Tracks TRACE Spec v0.2.
Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
Quick start
pip install agentrust-trace-tests
trace-tests verify --record path/to/trust-record.jwt --level 1
A report you can hand to someone else
verify answers a question for the person running it. report produces an artifact for
somebody who was not there: an auditor, a counterparty, an acquirer.
trace-tests report --record trust-record.json --html report.html --json report.json --badge trace.svg
It runs every level up to --max-level rather than one, because the useful answer for
a reader is the highest level the record reaches, not whether it cleared the level someone
happened to pick. The HTML is self-contained: no scripts, no fonts, no external CSS, no
badge service, nothing fetched at open time.
Use --fail-under 1 to gate CI on a level. Without it the command always exits 0, which
is what you want when you are producing an artifact rather than enforcing a threshold.
The report is not evidence, and it says so on its face. It is unsigned HTML describing one run of one suite version, and anybody can edit it. So it carries the record's digest, the suite and library versions, and the exact command to reproduce the result. A reader who does not trust the sender is told, in the artifact, to go check the record instead. A conformance report that looks authoritative and cannot be checked is the same shape of thing as a control plane writing its own log.
report.json is stable under schema: agentrust-io/trace-tests/report/1 for dashboards
and CI.
Test modules
| Module | ID | Tests |
|---|---|---|
| Envelope | TR-ENV |
EAT structure, required fields, iat validity |
| Signature | TR-SIG |
ES256/ES384/EdDSA, key binding, chain |
| Runtime | TR-RTE |
TEE platform, measurement format, RIM URI |
| Policy | TR-POL |
Bundle hash, enforcement mode, TEE binding |
| Transcript | TR-TXN |
Tool-call transcript hash binding (Phase 2+) |
| Transparency | TR-ANC |
SCITT receipt URI, inclusion proof |
| Provenance | TR-SCA |
SLSA level, builder URI, digest format |
Resources
| 📖 Full documentation | tests.agentrust-io.com |
| 📄 TRACE Specification | trace-spec |
| 🗂 Test schemas | schemas/ |
| 💬 Discussions | GitHub Discussions |
| 📋 Changelog | CHANGELOG.md |
Contributing
See CONTRIBUTING.md. New test cases must include a normative spec reference, a positive case, and a negative case with a structured error code (TR-<MODULE>-<NNN>).
2 maintainers
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file agentrust_trace_tests-0.5.0.tar.gz.
File metadata
- Download URL: agentrust_trace_tests-0.5.0.tar.gz
- Upload date:
- Size: 95.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
e4261c1b5dd525ce4c4e52242c992462e9744a21f152bd1962699128fe70af18
|
|
| MD5 |
e27cb4c6478b62a63b057f14c0daed32
|
|
| BLAKE2b-256 |
7c2eaf1c20d4f9f6501451c1a4ce2011031b2363575845a0881c4e7028000a6d
|
Provenance
The following attestation bundles were made for agentrust_trace_tests-0.5.0.tar.gz:
Publisher:
release.yml on agentrust-io/trace-tests
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
agentrust_trace_tests-0.5.0.tar.gz -
Subject digest:
e4261c1b5dd525ce4c4e52242c992462e9744a21f152bd1962699128fe70af18 - Sigstore transparency entry: 2388787529
- Sigstore integration time:
-
Permalink:
agentrust-io/trace-tests@97cccb47b1eba769d061074acbcc50a8fb2d7295 -
Branch / Tag:
refs/tags/v0.5.0 - Owner: https://github.com/agentrust-io
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@97cccb47b1eba769d061074acbcc50a8fb2d7295 -
Trigger Event:
release
-
Statement type:
File details
Details for the file agentrust_trace_tests-0.5.0-py3-none-any.whl.
File metadata
- Download URL: agentrust_trace_tests-0.5.0-py3-none-any.whl
- Upload date:
- Size: 26.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
9026f903e4ee1542ecfb594d9d39716f83b31ffae3884a28bb5b62ac953bdd17
|
|
| MD5 |
be16927a17e070884825b6c412f8ae1f
|
|
| BLAKE2b-256 |
84524de5c6f0e1ee09b8beb5f23cb1b4422828d264897819ad154705fb9752bd
|
Provenance
The following attestation bundles were made for agentrust_trace_tests-0.5.0-py3-none-any.whl:
Publisher:
release.yml on agentrust-io/trace-tests
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
agentrust_trace_tests-0.5.0-py3-none-any.whl -
Subject digest:
9026f903e4ee1542ecfb594d9d39716f83b31ffae3884a28bb5b62ac953bdd17 - Sigstore transparency entry: 2388787557
- Sigstore integration time:
-
Permalink:
agentrust-io/trace-tests@97cccb47b1eba769d061074acbcc50a8fb2d7295 -
Branch / Tag:
refs/tags/v0.5.0 - Owner: https://github.com/agentrust-io
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@97cccb47b1eba769d061074acbcc50a8fb2d7295 -
Trigger Event:
release
-
Statement type:
