Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

test(conformance): finish ACTION historical validity-window replay cases

Open
  • Is something wrong?
#36 15 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@K611-dot is already working on this.

Since Aug 25, 2026.

Assessment

This issue has not been assessed yet.

Description

help wanted

Context

The A2A delegation-link field has landed in agentrust-io/trace-spec#80, and the public delegation verifier API has landed in agentrust-io/agent-manifest#218. cA2A also now has a conformance suite from #28.

A useful follow-up would be fixture-style conformance coverage that connects these pieces to offline-verifiable action evidence:

delegation block -> public delegation verifier -> TRACE/action receipt evidence

This would line up with the action receipt discussion in agentrust-io/trace-spec#66 and the embodied action receipt example in agentrust-io/examples#36.

Proposed fixture cases

MUST-level cases:

  • valid root -> delegated child TRACE record, with delegation.parent_record_hash matching the canonical parent record hash
  • valid delegation.credential_id that resolves through the public agent-manifest delegation verifier
  • parent record present but canonical hash mismatch
  • missing parent record for a non-root delegated hop
  • delegation credential id unknown to the verifier
  • delegation credential signature invalid
  • delegation credential expired or not yet valid
  • delegatee/session/channel binding mismatch
  • requested action outside the effective delegated scope
  • valid delegation chain with local policy denial, reported as valid provenance plus authorization/policy denial rather than malformed evidence

SHOULD-level cases:

  • multi-hop attenuation where each hop narrows scope
  • attempted scope widening at an intermediate hop
  • valid negative outcome, such as delegated action rejected by the controller, treated as useful evidence rather than verifier failure
  • external subject identifier/digest present for cross-system resolution, but not dereferenced by base TRACE verification

Boundary

The verifier should distinguish three classes of result:

  1. provenance invalid: malformed delegation block, bad hash, unknown credential, invalid signature, broken binding
  2. authorization invalid: valid delegation evidence, but requested action is outside delegated scope
  3. valid negative outcome: delegation/action was well evidenced, but local policy/controller denied or rejected the action

That boundary keeps cA2A compatible with embodied/action evidence: the system can prove what was authorized and attempted without claiming that the physical or business-world outcome succeeded.

I can help with the fixture shape or a follow-up PR once the preferred fixture location/API surface is clear.

Dominant language
Python
Stars
9
Forks
14
Avg merge
17h 24m
Merged PRs (30d)
56

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/ca2a

All issues in agentrust-io/ca2a

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.