Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

test(conformance): finish ACTION historical validity-window replay cases

Aperta
  • Qualcosa non va?
#36 15 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@K611-dot ci sta già lavorando.

Dal 25/8/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

help wanted

Context

The A2A delegation-link field has landed in agentrust-io/trace-spec#80, and the public delegation verifier API has landed in agentrust-io/agent-manifest#218. cA2A also now has a conformance suite from #28.

A useful follow-up would be fixture-style conformance coverage that connects these pieces to offline-verifiable action evidence:

delegation block -> public delegation verifier -> TRACE/action receipt evidence

This would line up with the action receipt discussion in agentrust-io/trace-spec#66 and the embodied action receipt example in agentrust-io/examples#36.

Proposed fixture cases

MUST-level cases:

  • valid root -> delegated child TRACE record, with delegation.parent_record_hash matching the canonical parent record hash
  • valid delegation.credential_id that resolves through the public agent-manifest delegation verifier
  • parent record present but canonical hash mismatch
  • missing parent record for a non-root delegated hop
  • delegation credential id unknown to the verifier
  • delegation credential signature invalid
  • delegation credential expired or not yet valid
  • delegatee/session/channel binding mismatch
  • requested action outside the effective delegated scope
  • valid delegation chain with local policy denial, reported as valid provenance plus authorization/policy denial rather than malformed evidence

SHOULD-level cases:

  • multi-hop attenuation where each hop narrows scope
  • attempted scope widening at an intermediate hop
  • valid negative outcome, such as delegated action rejected by the controller, treated as useful evidence rather than verifier failure
  • external subject identifier/digest present for cross-system resolution, but not dereferenced by base TRACE verification

Boundary

The verifier should distinguish three classes of result:

  1. provenance invalid: malformed delegation block, bad hash, unknown credential, invalid signature, broken binding
  2. authorization invalid: valid delegation evidence, but requested action is outside delegated scope
  3. valid negative outcome: delegation/action was well evidenced, but local policy/controller denied or rejected the action

That boundary keeps cA2A compatible with embodied/action evidence: the system can prove what was authorized and attempted without claiming that the physical or business-world outcome succeeded.

I can help with the fixture shape or a follow-up PR once the preferred fixture location/API surface is clear.

Lingua principale
Python
Stelle
9
Fork
14
Merge medio
16h 43m
PR unite (30g)
54

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agentrust-io/ca2a

Tutte le issue di agentrust-io/ca2a

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.