TR-ANC-002 can earn Level 2 without binding receipt root/count to the transparency-named entry
I maintainer di solito rispondono entro 1 giorno
@rajnisht7 ci sta già lavorando.
Dal 20/10/2026.
Valutazione
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Idoneità per principianti
- 25/100
- Tipo di issue
- Funzionalità
- Chiarezza
- Abbastanza chiara
- Stato di attività
- Attiva
- Stack tecnologico
- python
- Ambito
- testing-qa
Direzione di ricerca
Read the original discussion in trace-tests #92 and the coordination issues trace-registry #102 and trace-spec #280 before proposing implementation work. Inspect src/trace_tests/modules/tr_anc.py and the Anchor Format entry-binding relation in spec/registry-anchor-v1.md. Done requires a maintainer decision on whether Level 2 must bind the receipt root and count to the entry named by transparency; the issue does not specify an implementation.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
Continued from trace-tests agentrust-io/trace-spec#547 as part of repository consolidation. Original author: @solloek369-arch. The original discussion and maintainer decisions remain in that linked issue; this migration does not resolve the conformance question. Implementation coordination also remains in trace-registry agentrust-io/trace-tests#102 and trace-spec #280.
Lineage: trace-tests agentrust-io/trace-tests#70 → trace-tests agentrust-io/trace-tests#79 → caller root/count ↔ transparency-named entry binding
What TR-ANC-002 checks today
At the exact unreleased main snapshots below, TR-ANC-002
replays an inclusion proof against merkle_root and leaf_count supplied in
the caller receipt.
It does not establish that those values belong to the registry entry named by
the transparency URI in the signed record. A receipt can therefore be
internally consistent and still earn Level 2 without that authority relation
having been established.
What the Anchor Format says
The Anchor Format
identifies the registry entry through the record's transparency URI. The
question here is whether a Level-2 verdict must also establish that the caller
receipt's root and count describe that identified entry.
Decisive controls
| World | Suite result | Independent paired-entry check |
|---|---|---|
| Matching sealed paired entry | ✅ Level 2 | ✅ established |
| Wrong caller root | ❌ refused | — |
| Only paired-entry root changed | ✅ Level 2 | ❌ not established |
| Only paired-entry count changed | ✅ Level 2 | ❌ not established |
The Merkle check is load-bearing: a wrong caller root is refused. The narrower
gap is that changing only the separately retained paired entry's root or count
leaves the suite at Level 2 while the independent check reports the binding not
established.
Decision requested
Is binding of the caller receipt's merkle_root and leaf_count to the
registry entry named by transparency part of what a Level-2 verdict must
establish?
No upstream API or network-resolution design is proposed here.
Currentness and scope
Currentness checked: 2026-09-02T10:31:53Z — the trace-tests and
trace-spec default branches matched these exact unreleased pins at that time:
trace-tests:98c34c7b62f55886ba170609f268645994ba8c1ftrace-spec:98aae176aa9ae4053d944624dad7629c76789ff7
Replay if TR-ANC-002 or the Anchor Format entry-binding relation changes.
This does not claim released impact, registry compromise, remote
exploitability, severity, production prevalence, downstream authorization, or
a prescribed upstream API.
Evidence
An unsigned self-verifying local packet, including paired worlds and replay
receipts, is available on request:
d32607ee1f272c8c16f39e44b323e0bd85cd7e897dc3e330a6b5807670318410
- Lingua principale
- Python
- Stelle
- 37
- Fork
- 33
- Merge medio
- 1g 9h
- PR unite (30g)
- 121
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di agentrust-io/trace-spec
-
prototype(azure_execution_binding): bind HCLAkPub exponent e and key size, reject duplicate JSON keys, and harden _secure_boot_state and authenticode_sha256Forse già presa @drk-ram l’ha presa 1 giorno fa. Apertaneeds-review:MEDIUM
Difficoltà 4/5 3-5 giorni Idoneità per principianti 20/100
agentrust-io/trace-spec#613 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
content_marking: validate record.alg against record.hash prefix, reject unknown assertion fields, and check anchor agreementForse già presa @drk-ram l’ha presa 1 giorno fa. Apertaneeds-review:MEDIUM
Difficoltà 4/5 3-5 giorni Idoneità per principianti 35/100
agentrust-io/trace-spec#614 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
adapters: validate data_class, policy/appraisal enums, and URI fields in TraceAGTAdapter and TraceSandboxAdapterForse già presa @drk-ram l’ha presa 1 giorno fa. Apertaneeds-review:MEDIUM
Difficoltà 4/5 3-5 giorni Idoneità per principianti 20/100
agentrust-io/trace-spec#615 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
trust-record-verify: reject non-object inputs in parentRecordHash, verifyDelegationLink, and bundleDigestForse già presa @drk-ram l’ha presa 1 giorno fa. Apertaneeds-review:MEDIUM
Difficoltà 2/5 1-3 ore Idoneità per principianti 35/100
agentrust-io/trace-spec#616 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
intent_bridge,successor_observation: validate caller options and trusted JWKs at entry and deep-copy observation before predicateForse già presa @drk-ram l’ha presa 1 giorno fa. Apertaneeds-review:MEDIUM
Difficoltà 4/5 1-2 giorni Idoneità per principianti 35/100
agentrust-io/trace-spec#617 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
Tutte le issue di agentrust-io/trace-spec
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 84/100
-
bug
Difficoltà 2/5 1-3 ore Idoneità per principianti 77/100
AstrBotDevs/AstrBot#10720 ·
I maintainer di solito rispondono entro 1 giorno
-
fix(xiaomi): curated picker list still offers six ids that return 400 (plan-limited vs retired)Apertacause/upstream comp/cli P2 provider/other tool/file type/bug
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
NousResearch/hermes-agent#143900 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 1/5 1-3 ore Idoneità per principianti 85/100
WLAN-Pi/wlanpi-profiler#341 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 77/100
I maintainer di solito rispondono entro 1 giorno