From 21985ca47d4754fe7e3a79038d570651f5e7d93e Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Tue, 5 May 2026 00:27:29 -0400 Subject: [PATCH 1/3] Register ExternalTrustSignalProvider schema kind --- src/agent_machine/contracts.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/agent_machine/contracts.py b/src/agent_machine/contracts.py index 3caa256..6c9b7c9 100644 --- a/src/agent_machine/contracts.py +++ b/src/agent_machine/contracts.py @@ -53,6 +53,7 @@ def schema_by_kind(root: Path | None = None) -> dict[str, Path]: "AgentRegistryGrant": base / "agent-registry-grant.schema.json", "CacheTier": base / "cache-tier.schema.json", "DeploymentReceipt": base / "deployment-receipt.schema.json", + "ExternalTrustSignalProvider": base / "external-trust-signal-provider.schema.json", "InferenceProvider": base / "inference-provider.schema.json", "PolicyAdmission": base / "policy-admission.schema.json", "ReleaseEvidenceBundle": base / "release-evidence-bundle.schema.json", From 9858d1a7252087a846c6a5edc9e0ce7e657c7bb8 Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Tue, 5 May 2026 00:37:20 -0400 Subject: [PATCH 2/3] Add ExternalTrustSignalProvider schema --- ...external-trust-signal-provider.schema.json | 130 ++++++++++++++++++ 1 file changed, 130 insertions(+) create mode 100644 contracts/external-trust-signal-provider.schema.json diff --git a/contracts/external-trust-signal-provider.schema.json b/contracts/external-trust-signal-provider.schema.json new file mode 100644 index 0000000..aac3117 --- /dev/null +++ b/contracts/external-trust-signal-provider.schema.json @@ -0,0 +1,130 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "urn:srcos:agent-machine:schema:external-trust-signal-provider:v0.1.0", + "title": "ExternalTrustSignalProvider", + "description": "Secret-free adapter request/response contract for optional non-authoritative external identity, reputation, certificate-tier, counterparty, and registry lookup signals used as Agent Registry verifier inputs.", + "type": "object", + "additionalProperties": false, + "required": ["specVersion", "id", "kind", "request", "response", "receiptSafety", "observedAt"], + "$defs": { + "signalType": { + "type": "string", + "enum": ["agent-identity", "cert-tier", "reputation-score", "counterparty-check", "registry-lookup", "other"] + }, + "sha256Digest": { + "type": ["string", "null"], + "pattern": "^sha256:[a-f0-9]{64}$" + }, + "freshness": { + "type": "object", + "additionalProperties": false, + "required": ["maxAgeSeconds", "observedAgeSeconds", "fresh"], + "properties": { + "maxAgeSeconds": { "type": "integer", "minimum": 0 }, + "observedAgeSeconds": { "type": "integer", "minimum": 0 }, + "fresh": { "type": "boolean" } + } + }, + "signature": { + "type": "object", + "additionalProperties": false, + "required": ["required", "observed", "signatureRef", "signerRef"], + "properties": { + "required": { "type": "boolean" }, + "observed": { "type": "boolean" }, + "signatureRef": { "type": ["string", "null"] }, + "signerRef": { "type": ["string", "null"] } + } + }, + "externalTrustSignal": { + "type": "object", + "additionalProperties": false, + "required": ["providerRef", "signalType", "signalRef", "signalDigest", "verifiedAt", "freshness", "signature", "authority", "failureReason"], + "properties": { + "providerRef": { "type": "string" }, + "signalType": { "$ref": "#/$defs/signalType" }, + "signalRef": { "type": "string" }, + "signalDigest": { "$ref": "#/$defs/sha256Digest" }, + "verifiedAt": { "type": "string" }, + "freshness": { "$ref": "#/$defs/freshness" }, + "signature": { "$ref": "#/$defs/signature" }, + "authority": { "type": "string", "const": "non-authoritative-verifier-input" }, + "failureReason": { "type": ["string", "null"] }, + "notes": { "type": "array", "items": { "type": "string" } } + } + } + }, + "properties": { + "specVersion": { "type": "string", "const": "0.1.0" }, + "id": { + "type": "string", + "pattern": "^urn:srcos:agent-machine:external-trust-signal-provider:[a-z0-9][a-z0-9-]*$" + }, + "kind": { "type": "string", "const": "ExternalTrustSignalProvider" }, + "request": { + "type": "object", + "additionalProperties": false, + "required": ["requestId", "providerRef", "agentPodId", "requestedAgentIdentityRef", "sessionRef", "workroomRef", "topicRef", "requestedSignalTypes", "verificationFreshnessSeconds", "requestedExpiresAt", "signatureRequired"], + "properties": { + "requestId": { "type": "string" }, + "providerRef": { "type": "string" }, + "agentPodId": { + "type": "string", + "pattern": "^urn:srcos:agent-machine:agent-pod:[a-z0-9][a-z0-9-]*$" + }, + "requestedAgentIdentityRef": { "type": "string" }, + "sessionRef": { "type": "string" }, + "workroomRef": { "type": ["string", "null"] }, + "topicRef": { "type": ["string", "null"] }, + "requestedSignalTypes": { + "type": "array", + "items": { "$ref": "#/$defs/signalType" }, + "minItems": 1, + "uniqueItems": true + }, + "verificationFreshnessSeconds": { "type": "integer", "minimum": 0 }, + "requestedExpiresAt": { "type": ["string", "null"] }, + "signatureRequired": { "type": "boolean" } + } + }, + "response": { + "type": "object", + "additionalProperties": false, + "required": ["status", "usableForGrantResolution", "providerRef", "authority", "verifiedAt", "freshness", "signals", "failureReason"], + "properties": { + "status": { + "type": "string", + "enum": ["available", "unavailable", "stale", "malformed", "unsigned", "denied", "error"] + }, + "usableForGrantResolution": { "type": "boolean" }, + "providerRef": { "type": "string" }, + "authority": { "type": "string", "const": "non-authoritative-verifier-input" }, + "verifiedAt": { "type": ["string", "null"] }, + "freshness": { "$ref": "#/$defs/freshness" }, + "signals": { + "type": "array", + "items": { "$ref": "#/$defs/externalTrustSignal" } + }, + "failureReason": { "type": ["string", "null"] } + } + }, + "receiptSafety": { + "type": "object", + "additionalProperties": false, + "required": ["includeRawContent", "rawPromptContentIncluded", "rawKvCacheContentIncluded", "secretValuesIncluded", "privateMemoryIncluded", "apiKeysIncluded", "walletPrivateKeysIncluded", "rawCredentialsIncluded", "rawUserDataIncluded"], + "properties": { + "includeRawContent": { "type": "boolean", "const": false }, + "rawPromptContentIncluded": { "type": "boolean", "const": false }, + "rawKvCacheContentIncluded": { "type": "boolean", "const": false }, + "secretValuesIncluded": { "type": "boolean", "const": false }, + "privateMemoryIncluded": { "type": "boolean", "const": false }, + "apiKeysIncluded": { "type": "boolean", "const": false }, + "walletPrivateKeysIncluded": { "type": "boolean", "const": false }, + "rawCredentialsIncluded": { "type": "boolean", "const": false }, + "rawUserDataIncluded": { "type": "boolean", "const": false } + } + }, + "observedAt": { "type": "string" }, + "labels": { "type": "object", "additionalProperties": { "type": "string" } } + } +} From d111762a51b07503d7ee308c30732b9d55fb2e1d Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Tue, 5 May 2026 00:42:38 -0400 Subject: [PATCH 3/3] Add active ExternalTrustSignalProvider example --- ...external-trust-signal-provider.active.json | 147 ++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 examples/external-trust-signal-provider.active.json diff --git a/examples/external-trust-signal-provider.active.json b/examples/external-trust-signal-provider.active.json new file mode 100644 index 0000000..c1532b2 --- /dev/null +++ b/examples/external-trust-signal-provider.active.json @@ -0,0 +1,147 @@ +{ + "specVersion": "0.1.0", + "id": "urn:srcos:agent-machine:external-trust-signal-provider:local-pch-style-active", + "kind": "ExternalTrustSignalProvider", + "request": { + "requestId": "urn:srcos:agent-machine:external-trust-request:local-pch-style-active", + "providerRef": "urn:srcos:external-trust-provider:pch-style-local-mirror", + "agentPodId": "urn:srcos:agent-machine:agent-pod:local-podman-llama-cpp", + "requestedAgentIdentityRef": "urn:srcos:agent:local-inference-provider", + "sessionRef": "urn:srcos:session:local-bootstrap", + "workroomRef": "urn:srcos:workroom:local-default", + "topicRef": "urn:srcos:topic:agent-machine", + "requestedSignalTypes": [ + "agent-identity", + "cert-tier", + "reputation-score", + "registry-lookup" + ], + "verificationFreshnessSeconds": 3600, + "requestedExpiresAt": "2026-05-04T13:50:00Z", + "signatureRequired": true + }, + "response": { + "status": "available", + "usableForGrantResolution": true, + "providerRef": "urn:srcos:external-trust-provider:pch-style-local-mirror", + "authority": "non-authoritative-verifier-input", + "verifiedAt": "2026-05-04T12:50:10Z", + "freshness": { + "maxAgeSeconds": 3600, + "observedAgeSeconds": 10, + "fresh": true + }, + "signals": [ + { + "providerRef": "urn:srcos:external-trust-provider:pch-style-local-mirror", + "signalType": "agent-identity", + "signalRef": "urn:srcos:external-trust-signal:local-agent-identity", + "signalDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111", + "verifiedAt": "2026-05-04T12:50:10Z", + "freshness": { + "maxAgeSeconds": 3600, + "observedAgeSeconds": 10, + "fresh": true + }, + "signature": { + "required": true, + "observed": true, + "signatureRef": "urn:srcos:signature:local-agent-identity", + "signerRef": "urn:srcos:signer:local-trust-mirror" + }, + "authority": "non-authoritative-verifier-input", + "failureReason": null, + "notes": [ + "Identity signal is adapter input only; local Agent Registry remains authoritative." + ] + }, + { + "providerRef": "urn:srcos:external-trust-provider:pch-style-local-mirror", + "signalType": "cert-tier", + "signalRef": "urn:srcos:external-trust-signal:local-agent-cert-tier-bronze", + "signalDigest": "sha256:2222222222222222222222222222222222222222222222222222222222222222", + "verifiedAt": "2026-05-04T12:50:10Z", + "freshness": { + "maxAgeSeconds": 3600, + "observedAgeSeconds": 10, + "fresh": true + }, + "signature": { + "required": true, + "observed": true, + "signatureRef": "urn:srcos:signature:local-agent-cert-tier", + "signerRef": "urn:srcos:signer:local-trust-mirror" + }, + "authority": "non-authoritative-verifier-input", + "failureReason": null, + "notes": [ + "Cert-tier signal cannot authorize activation by itself." + ] + }, + { + "providerRef": "urn:srcos:external-trust-provider:pch-style-local-mirror", + "signalType": "reputation-score", + "signalRef": "urn:srcos:external-trust-signal:local-agent-reputation-score", + "signalDigest": "sha256:3333333333333333333333333333333333333333333333333333333333333333", + "verifiedAt": "2026-05-04T12:50:10Z", + "freshness": { + "maxAgeSeconds": 3600, + "observedAgeSeconds": 10, + "fresh": true + }, + "signature": { + "required": true, + "observed": true, + "signatureRef": "urn:srcos:signature:local-agent-reputation-score", + "signerRef": "urn:srcos:signer:local-trust-mirror" + }, + "authority": "non-authoritative-verifier-input", + "failureReason": null, + "notes": [ + "Reputation score can inform risk but cannot widen requested scope." + ] + }, + { + "providerRef": "urn:srcos:external-trust-provider:pch-style-local-mirror", + "signalType": "registry-lookup", + "signalRef": "urn:srcos:external-trust-signal:local-agent-registry-lookup", + "signalDigest": "sha256:4444444444444444444444444444444444444444444444444444444444444444", + "verifiedAt": "2026-05-04T12:50:10Z", + "freshness": { + "maxAgeSeconds": 3600, + "observedAgeSeconds": 10, + "fresh": true + }, + "signature": { + "required": true, + "observed": true, + "signatureRef": "urn:srcos:signature:local-agent-registry-lookup", + "signerRef": "urn:srcos:signer:local-trust-mirror" + }, + "authority": "non-authoritative-verifier-input", + "failureReason": null, + "notes": [ + "Registry lookup is evidence for local grant resolution, not authorization." + ] + } + ], + "failureReason": null + }, + "receiptSafety": { + "includeRawContent": false, + "rawPromptContentIncluded": false, + "rawKvCacheContentIncluded": false, + "secretValuesIncluded": false, + "privateMemoryIncluded": false, + "apiKeysIncluded": false, + "walletPrivateKeysIncluded": false, + "rawCredentialsIncluded": false, + "rawUserDataIncluded": false + }, + "observedAt": "2026-05-04T12:50:10Z", + "labels": { + "sourceos.external-trust.prototype": "true", + "sourceos.external-trust.usable": "true", + "sourceos.external-trust.authority": "non-authoritative" + } +}