From e566c2d1741d4f41f2762eb5aeeb19b2718cf345 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Fri, 31 Jul 2026 19:31:05 -0700 Subject: [PATCH] docs(copilot): record why no signed artifact is emitted, and file the spec gap I said TRACE emission was the next step for the Copilot check. Building it showed that is the wrong artifact, so this corrects both READMEs rather than leaving a promise I no longer think is right. TRACE describes an execution. This check describes a composition. Agent Manifest is the right artifact for a composition, and every level requires artifacts.model_identity, which a repository cannot know: Copilot picks the model at session time from the user's plan and settings, and the same repository serves every model with an identical contributed composition. The available workarounds are all claims that would not survive review. provider github with model_id copilot names a product, not a model. model_id unknown asserts a binding to a thing called "unknown". Omitting the artifact is non-conformant at every level. CONTRIBUTING requires every claim be verifiable in two minutes, so the integration ships without a record. Filed as agent-manifest#256 with three options and a preference. Worth noting the spec looks internally inconsistent here rather than merely incomplete: the verification result vocabulary already includes NOT_BOUND for every artifact, so a verifier can report a state that no conformant manifest is able to reach. No code change. The check behaves exactly as merged. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Imran Siddique --- README.md | 18 ++++++++++++++---- copilot/README.md | 17 +++++++++++++++++ 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 25cecbe..bf9aee0 100644 --- a/README.md +++ b/README.md @@ -40,10 +40,20 @@ which owns fingerprinting, comparison, baseline sealing and the report honesty r **Note on the Copilot entry.** It is a pull-request status check rather than a session hook, because Copilot's composition lives in the repository. It emits no -TRACE record and no Agent Manifest yet, so it claims neither: `integrates_with` in -the manifest schema offers only `cmcp`, `trace` and `agent-manifest`, and asserting -one of those today would be an unverifiable claim. Emitting a TRACE record per -checked pull request is the intended next step and is what would make one true. +TRACE record and no Agent Manifest, so it claims neither: `integrates_with` offers +only `cmcp`, `trace` and `agent-manifest`, and asserting one today would be an +unverifiable claim. + +That is currently blocked on a spec question rather than on implementation, tracked +in [agent-manifest#256](https://github.com/agentrust-io/agent-manifest/issues/256). +TRACE describes an execution and this check describes a composition, so a TRACE +record is the wrong artifact. Agent Manifest is the right one, but every level +requires `artifacts.model_identity`, and a repository cannot know the model: Copilot +picks it at session time from the user's plan and settings. The same repository +serves every model, with an identical contributed composition. Manufacturing a +model to satisfy the field would be exactly the kind of unverifiable claim +`CONTRIBUTING.md` rules out, so the integration ships without one until the spec +has a way to express a composition whose model is unknowable at authoring time. ## Community diff --git a/copilot/README.md b/copilot/README.md index ef7a4e7..45db20e 100644 --- a/copilot/README.md +++ b/copilot/README.md @@ -95,6 +95,23 @@ two other engines in this repo, so the shared core covers the tree. outside the repository and are invisible to a check that runs inside it. If your organisation sets Copilot instructions centrally, this check does not see them. - **It is not a sandbox.** It reports composition, it does not constrain execution. +- **It emits no signed record**, unlike the other integrations here, and that is a + spec question rather than a missing feature. See + [agent-manifest#256](https://github.com/agentrust-io/agent-manifest/issues/256). + + A TRACE record is the wrong artifact: TRACE describes an execution, and this check + describes a composition. Agent Manifest is the right one, and every level requires + `artifacts.model_identity`. A repository cannot know the model. Copilot chooses it + at session time from the user's plan and settings, so the same repository serves + every model with an identical contributed composition. + + `provider: github, model_id: copilot` would describe a product rather than a + model, and `model_id: unknown` would assert a binding to a thing called "unknown". + Either is the sort of unverifiable claim this repository's contributing rules + exclude, so the check ships without a record until the spec can express a + composition whose model is unknowable when it is authored. Notably the verifier + vocabulary already has `NOT_BOUND` for every artifact, and no conformant manifest + can currently produce it. ## Inputs