diff --git a/docs/15-milestones.md b/docs/15-milestones.md index 1f31941..0c01a4c 100644 --- a/docs/15-milestones.md +++ b/docs/15-milestones.md @@ -2,10 +2,10 @@ ## Milestone 1 — Trust Artifact Reference Implementations -- [ ] `agent-trust-infra/`: Ship reference implementation for all three artifact types (AgentBOM, MCP Posture, Trust Passport) -- [ ] `agent-trust-infra/cli`: CLI emits valid AgentBOM JSON for any agent run (`agent-trust-cli --run-id --output agentbom.json`) -- [ ] `agent-trust-infra/`: MCP Posture verification passes against sample agent manifest (`verify-posture --manifest examples/manifest.yaml`) -- [ ] `agent-trust-infra/`: Trust Passport export includes signed AEP events (`passport export --format json --include-aep`) +- [ ] `agentbom/`: Ship reference implementation for all three artifact types (AgentBOM, MCP Posture, Trust Passport) +- [ ] `agentbom/cli`: CLI emits valid AgentBOM JSON for any agent run (`agentbom --run-id --output agentbom.json`) +- [ ] `agentbom/`: MCP Posture verification passes against sample agent manifest (`verify-posture --manifest examples/manifest.yaml`) +- [ ] `agentbom/`: Trust Passport export includes signed AEP events (`passport export --format json --include-aep`) - [ ] `docs/`: Publish trust artifact spec docs with JSON schema validation (`docs/trust-artifacts.md` with embedded schema) - [ ] `tests/`: Integration test suite passes for all three artifact types (`npm run test:trust-artifacts`) @@ -44,7 +44,7 @@ - [ ] `healthcare-agent/`: Healthcare domain workload lands with HIPAA-compliant evidence collection and PHI-audit trails - [ ] `devops-agent/`: DevOps domain workload with deployment verification and infrastructure-as-code evidence capture - [ ] `finance-agent/`: Finance domain workload with SOX compliance controls and transaction-replay verification -- [ ] `agent-trust-infra/`: Trust propagation protocol enables artifact chaining across domain boundaries (AgentBOM → AgentBOM) +- [ ] `agentbom/`: Trust propagation protocol enables artifact chaining across domain boundaries (AgentBOM → AgentBOM) - [ ] `wasmagent-ops/`: Continuous verification daemon monitors running agents and alerts on trust-policy violations - [ ] `docs/`: Domain workload authoring guide with templates for new vertical-specific agents and verifier patterns - [ ] `wasmagent-js/`: Policy-as-code framework enables declarative trust rules (e.g., "require AEP events for all data mutations") diff --git a/docs/architecture.md b/docs/architecture.md index 776ae13..340de93 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -33,9 +33,11 @@ Ingests AEP traces, applies paired-statistics checks as an evidence admission gate for training data, and records every training run as auditable evidence. -### Trust artifacts — `agent-trust-infra` +### Trust artifacts — `agentbom` -Layers machine-readable identity and policy posture onto each run: +Layers machine-readable identity and policy posture onto each run +(`@wasmagent/agentbom-core` + `@wasmagent/agentbom-cli`; successor to the +archived `agent-trust-infra`): - **AgentBOM** — bill of materials for an agent (model, tools, dependencies). - **MCP Posture** — declared and observed MCP surface and capabilities. @@ -147,11 +149,11 @@ graph TB - **Evidence Store** — Immutable storage for admitted traces - **Training Evidence Index** — Queryable index of auditable training data -### Trust artifacts layer — `agent-trust-infra` +### Trust artifacts layer — `agentbom` ```mermaid graph TB - subgraph agent_trust_infra["agent-trust-infra"] + subgraph agentbom["agentbom"] BOM[AgentBOM Generator] Posture[MCP Posture Analyzer] Passport[Trust Passport Generator] @@ -171,7 +173,7 @@ graph TB Artifacts[Trust Artifacts] --> Schema - style agent_trust_infra fill:#f3e5f5 + style agentbom fill:#f3e5f5 style Artifacts fill:#fff4e6 ``` @@ -273,6 +275,6 @@ graph TB 1. `wasmagent-js` protects a run and emits AEP events. 2. Workloads such as `bscode` produce verifiable runtime traces. 3. `trace-pipeline` admits and stores those traces as evidence. -4. `agent-trust-infra` attaches AgentBOM, MCP Posture, and Trust Passport. +4. `agentbom` attaches AgentBOM, MCP Posture, and Trust Passport. 5. `open-agent-audit` renders the chain into audit reports. 6. `fresharena` evaluates agents adversarially; results re-enter step 3. diff --git a/docs/evaluation-summary.md b/docs/evaluation-summary.md index 16d0c00..8373663 100644 --- a/docs/evaluation-summary.md +++ b/docs/evaluation-summary.md @@ -21,7 +21,7 @@ and re-usable. AEP evidence into `trace-pipeline`. - `trace-pipeline` — admits evaluation runs as evidence and records them in the training-audit log. -- `agent-trust-infra` — attaches AgentBOM, MCP Posture, and Trust Passport to +- `agentbom` — attaches AgentBOM, MCP Posture, and Trust Passport to each evaluated run so results bind to a specific, reproducible configuration. @@ -29,5 +29,5 @@ and re-usable. Evaluation results are not a leaderboard endpoint. They re-enter the evidence chain, where they inform training-data admission (`trace-pipeline`), audit -reporting (`open-agent-audit`), and trust posture (`agent-trust-infra`). This +reporting (`open-agent-audit`), and trust posture (`agentbom`). This keeps the runtime, evidence, and audit story grounded in measured behavior. diff --git a/docs/roadmap.md b/docs/roadmap.md index 6c84701..8e8256d 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -20,12 +20,13 @@ maturity tiers in [`repository-boundaries.md`](repository-boundaries.md): - **⭐ Core** (`wasmagent-js`, `wasmagent-protocol`, `symkernel`, - `agent-trust-infra`, and the planned `wasmagent-py`) — runtime, protocol, + `agentbom`, and the planned `wasmagent-py`) — runtime, protocol, verification, and trust artifacts. Sustained long-term investment. AEP is their connective standard, sedimented from the shipping runtime and now versioned in `wasmagent-protocol`. -- **🛠 Official tooling** — CLI, devtools, examples, starters. Planned; no - public repos yet. The tree reserves a home for them. +- **🛠 Official tooling** — CLI, devtools, examples, starters. Landing: + `@wasmagent/agentbom-cli` (in `agentbom`) and `agent-golden-path` (the + runnable provable-stack reference app) are public; more devtools planned. - **🔌 Evidence surfaces** (`wasmagent-proxy`, `trace-pipeline`, `wasmagent-train-replay`) — extend Core to specific surfaces. Once their roadmaps land they move to **community maintenance**; not retired — code and @@ -61,7 +62,10 @@ The machine-readable `focus` field in - 🚧 `symkernel` — Go symbolic verification backend: cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT satisfiability proofs. OPA-style HTTP service; consumed by wasmagent-js (CelGoVerifier / Z3Verifier) and - future wasmagent-py via a thin adapter. Deploys on Cloudflare Containers. + future wasmagent-py via a thin adapter. Now imports **OPA Rego and AWS Cedar + policies** (translated to CEL, fail-closed — `internal/policyimport`), + positioning symkernel as a Z3-proof backend for existing policy languages. + Deploys on Cloudflare Containers. ### Workloads ✅ @@ -82,8 +86,11 @@ The machine-readable `focus` field in ### Trust artifacts ✅ -- ✅ `agent-trust-infra` — AgentBOM, MCP Posture, and Trust Passport: spec, - reference implementation, and CLI. +- ✅ `agentbom` — AgentBOM, MCP Posture, and Trust Passport tooling: + `@wasmagent/agentbom-core` (validator, compliance checker, BOM diff/drift) + and `@wasmagent/agentbom-cli`. **Successor to `agent-trust-infra` (archived + 2026-07-29)**; the library packages and CLI now live here. Trust Passport / + AgentBOM canonical schema → `wasmagent-protocol`. - 🚧 EU AI Act Annex IV compliance mapping — draft covers 20/29 Annex IV sub-items; deadline 2026-08-02 (Article 11 effective for high-risk AI). @@ -115,7 +122,9 @@ The machine-readable `focus` field in ## Cross-cutting (planned) -- 📋 Ingestion adapters: OpenTelemetry GenAI, Langfuse, LangSmith. +- 🚧 Ingestion adapters: OpenTelemetry GenAI (field-level AEP↔OTel GenAI + mapping landed in `wasmagent-protocol/docs/AEP-OTEL-MAPPING.md`; adapter + code pending), Langfuse, LangSmith. - 📋 `erp-agent` public repository. - 📋 `wasmagent-py` Python runtime and symkernel adapter. - 📋 Cross-repo coherence patrol: org repo list ↔ profile README ↔ diff --git a/profile/README.md b/profile/README.md index e8d2f8a..b8f70a2 100644 --- a/profile/README.md +++ b/profile/README.md @@ -52,7 +52,7 @@ platform's identity. | --- | --- | | [wasmagent-js](https://github.com/WasmAgent/wasmagent-js) | **Runtime** · Embedded agent runtime v1.x — WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; `@wasmagent/mcp-posture` (migrated from `agent-trust-infra`), `@wasmagent/mcp-firewall`; adapters for A2A, AG-UI, AI SDK, and Claude Agent SDK. This is where signed evidence is born. | | [wasmagent-protocol](https://github.com/WasmAgent/wasmagent-protocol) | **Protocol** · Canonical AEP + compliance JSON Schemas — the single source of truth every repo agrees on. Published as `@wasmagent/protocol` (npm) and `wasmagent-protocol` (PyPI). | -| [symkernel](https://github.com/WasmAgent/symkernel) | **Verification** 🚧 · Go symbolic verification backend — cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT proofs; HTTP service consumed by wasmagent-js and wasmagent-py. "Proving it ran correctly" is the mission itself. | +| [symkernel](https://github.com/WasmAgent/symkernel) | **Verification** 🚧 · Go symbolic verification backend — cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT proofs; imports OPA Rego / AWS Cedar policies (translated to CEL, fail-closed) so existing policies gain formal proof. HTTP service consumed by wasmagent-js and wasmagent-py. "Proving it ran correctly" is the mission itself. | | [agentbom](https://github.com/WasmAgent/agentbom) | **Trust & BOM tooling** · `@wasmagent/agentbom-core`, `@wasmagent/agentbom-cli` — Agent Bill of Materials, validator, compliance checker, CLI tools. Migrated from `agent-trust-infra` (now archived). Trust Passport spec → [wasmagent-protocol](https://github.com/WasmAgent/wasmagent-protocol). | > **`wasmagent-py`** *(planned)* joins Core as the Python runtime sibling — same @@ -111,15 +111,15 @@ The broader industry is converging on *Agent Runtime / Agent OS* as the next inf **Reliability is necessary but not sufficient.** An agent that runs stably but whose behavior cannot be verified, audited, or proven correct is not ready for production systems, regulated industries, or multi-agent trust chains. The gap between "it finished" and "it did the right thing" is exactly where WasmAgent operates. -The Trusted Agent OS adds three layers that a plain Agent Runtime omits: +Provable AI agents rest on three layers that a plain Agent Runtime omits: | Layer | What it solves | Status | | --- | --- | --- | -| **Provable correctness** | `symkernel` — cel-go rules, wazero hard-isolation, Z3 SMT proofs | 🚧 in progress | +| **Provable correctness** | `symkernel` — cel-go rules, wazero hard-isolation, Z3 SMT proofs; imports OPA Rego / AWS Cedar policies (fail-closed) so existing policies gain formal proof | 🚧 in progress | | **Tamper-evident evidence** | AEP (Agent Evidence Protocol) — Ed25519-signed behavioral records at gateway and runtime | shipping in `wasmagent-js` v1.x | -| **Regulatory compliance** | EU AI Act Annex IV mapping, OWASP Agentic Top 10, NIST AI RMF | draft in `agent-trust-infra` | +| **Regulatory compliance** | EU AI Act Annex IV mapping, OWASP Agentic Top 10, NIST AI RMF | draft in `agentbom` | -The analogy: if Agent Runtime is Kubernetes (run things reliably at scale), the Trusted Agent OS is Kubernetes + audit logging + policy enforcement + compliance reporting — composable, open, and infrastructure-grade. +Put plainly: a plain Agent Runtime runs things reliably at scale; open infrastructure for *provable* AI agents adds the proof, signed evidence, and compliance mapping on top — composable, open, and infrastructure-grade. ## Architecture