Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Records cite evidence by URI alone, so an appraisal cannot be reproduced against what was appraised

Open
  • Is something wrong?
#280 6 comments 1 reaction 1 assignee View on GitHub

Maintainers usually reply within 1 day

@rajnisht7 is already working on this.

Since Oct 20, 2026.

Assessment

This issue has not been assessed yet.

Description

Spec section affected
§3.1 (Logical schema), §3.2 (Wire format), §3.3 (Verification), and §4.3
(Bindings TRACE adds), as carried by schema/trace-claim.json.

Problem

The observation

Four citation fields in the Trust Record carry a bare URI and no digest, so
what a record cites cannot be checked to be what was appraised.

At 5c69dc1679f866bdc6e997b782a91bb992458db1, schema/trace-claim.json carries
four citation fields that are a bare URI with no digest member beside them:
appraisal.policy_ref ("URI to the appraisal policy used."),
transparency (the SCITT receipt URI), runtime.rim_uri, and
model.aibom_uri (appraisal.verifier is also a bare URI but names the
verifier rather than an artifact, and is not counted). Three surfaces pair the URI with a
digest: policy.policy_uri beside policy.bundle_hash,
tool_transcript.transcript_uri beside tool_transcript.hash, and
build_provenance.provenance_uri beside build_provenance.digest; the
references[].digest member is optional, "when the producer holds it at issue
time". The four are top-level fields of the record, not entries in
references; the rules agentrust-io/trace-spec#226 quotes for that mechanism
do not reach them. appraisal.policy_ref appears in spec/trace-v0.2.md once, at line
241, as an example value.

The one bound object shows the spec already knows how: policy.bundle_hash
is required, patterned ^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$, described
as "SHA-256 or SHA-384 digest of the policy bundle in force at execution
time", and the spec prose states the binding in its own words (line 590):
"TRACE adds the binding: the policy bundle hash is sealed to the TEE
measurement". agentrust-io/trace-spec#276 (opened 2026-09-03) is doing the same work
for delegation.parent_record_hash, stating a preimage the schema alone left
open.

The consequence

A second verifier resolving the same URI at appraisal-check time verifies
whatever is deployed at that moment, not what was appraised. Where
resolution fails outright, agentrust-io/trace-spec#190 and now
agentrust-io/trace-spec#279 govern what the verifier records; where it
succeeds, nothing at this head makes "the same object" checkable. The tree
states the mechanism for schemas in its own words:

"A validator built from the bundle file alone resolves that by fetching the
published schema over the network, so it checks a nested statement against
whatever is deployed rather than against the file next to it, and with no
network it is unresolvable."
(tests/test_safe_integer_range.py lines 607-610 at
5c69dc1679f866bdc6e997b782a91bb992458db1)

Where this has been raised

  • agentrust-io/trace-spec#66, comment of 2026-08-18: appraisal "cites the
    policy that produced its verdict by bare URI: no digest, no resolution step".
  • The agentrust-io/trace-spec#187 review, 2026-08-18: "a verifier that cannot
    resolve a cited object reports a lower depth, or prose, or a third
    classification, or nothing".
  • agentrust-io/trace-spec#190 holds the recording-surface half as the deferred
    marker; this question is the binding half, one layer below it.
  • agentrust-io/trace-spec#260's receipt-outcome vocabulary (disclosed absence
    as a first-class outcome) is the pattern an answer here would join, now
    extracted as a general discipline in agentrust-io/trace-spec#279.
  • agentrust-io/trace-spec#279 (2026-09-03) collects the recording half across
    six threads: what a verifier says when it could not establish something.
    This question is one layer below it: what makes "established" reproducible
    against the cited object. An answer here gives its
    agentrust-io/trace-spec#190 row a determinate object to record.
  • agentrust-io/trace-spec#245 holds the preimage of parent_record_hash
    (ruled 2026-09-03; normative text in agentrust-io/trace-spec#276); it does
    not hold this question.
  • agentrust-io/trace-spec#249 holds reproducibility-as-evidence for
    software-only producers; its thread states its own boundary against
    agentrust-io/trace-spec#190's enum; it does not hold this question.

Proposed change

Decide one of three, on the record: digest binding of cited evidence is a
norm in v0.2; it is a profile option; or it is explicitly out of scope. Any
of the three closes this issue. Nothing is proposed beyond the decision: no
schema change is attached, and this is not a defect report. It is not
agentrust-io/trace-spec#279's question either: that tracker names how
absence is recorded, per surface; this one asks whether presence can be
bound.

Backward compatibility

  • Non-breaking (new optional field, informative addition)
  • Breaking (removes or changes required field, changes wire format, changes algorithm set)

Motivation

agentrust-io/trace-spec#271 made appraisal outcomes reproducible from
retained facts, and agentrust-io/trace-spec#279's fifth discipline (no
positive verdict by default) is the same rule one layer up; the citations
those outcomes rest on are the remaining unbound layer.

Measured at 5c69dc1679f866bdc6e997b782a91bb992458db1, 2026-09-03T23:02:28Z: 21 open
issues and 6 open PRs, none holding this question.

Dominant language
Python
Stars
37
Forks
33
Avg merge
1d 9h
Merged PRs (30d)
121

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/trace-spec

All issues in agentrust-io/trace-spec

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.