From ec0673119d44d47797ff08aeb5059f3d883f4c2d Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 3 Aug 2026 08:43:49 -0700 Subject: [PATCH 1/2] fix(ramen-ai-cmcp): emit the TRACE v0.2 profile The adapter hardcoded `tag:agentrust.io,2026:trace-v0.1`. The conformance suite cut over to v0.2 rather than dual-accepting, so `trace-tests` >= 0.4 rejects that value outright: TR-ENV FAIL eat_profile must be 'tag:agentrust-io.com,2026:trace-v0.2', got 'tag:agentrust.io,2026:trace-v0.1' The conformance workflow installs the released packages unpinned, which is deliberate (the weekly cron exists to catch drift against latest). The drift it caught is real: this job has been failing on main since 2026-07-28, and because the workflow is path-filtered to this integration, ordinary main pushes never run it. The breakage stayed invisible until three dependabot action bumps edited the workflow file and tripped the filter. The old value also named `agentrust.io` in its authority component, a domain this project has never controlled. Same defect class as trace-spec#107 and agent-manifest#263; this is one more surface of it. Changes: - `ramen_ai_trace.py`: `EAT_PROFILE` and the two docstring references. - `tests/test_mapping.py`: the assertion pinned the stale value, so the test suite was defending the bug. - `pyproject.toml`: floor `agentrust-trace>=0.5`. A consumer installing this adapter needs a version whose profile matches what the adapter emits; leaving it unbounded is how this drifted silently. CI stays unpinned by design. - `README.md`: the profile reference, and a stale "0.3.0" pin note. Verified locally against `agentrust-trace` 0.5.1 and `agentrust-trace-tests` 0.4.0: - `pytest integrations/ramen-ai-cmcp/tests -q` -> 14 passed - `trace-tests verify --record trust-record.jwt --level 0` -> PASS, 8 checks, exit 0 The TR-SIG-005 UNVERIFIED finding is unchanged and expected: the loader rejects a plain record carrying a top-level `signature`, so the gradable artifact is the unsigned payload. Already documented in the README. Co-Authored-By: Claude Opus 5 (1M context) --- integrations/ramen-ai-cmcp/README.md | 4 ++-- integrations/ramen-ai-cmcp/pyproject.toml | 2 +- integrations/ramen-ai-cmcp/ramen_ai_trace.py | 6 +++--- integrations/ramen-ai-cmcp/tests/test_mapping.py | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/integrations/ramen-ai-cmcp/README.md b/integrations/ramen-ai-cmcp/README.md index 903b41a..2ee26f9 100644 --- a/integrations/ramen-ai-cmcp/README.md +++ b/integrations/ramen-ai-cmcp/README.md @@ -4,13 +4,13 @@ Intercepts tool calls at the [cMCP](https://github.com/agentrust-io/cmcp) boundary, evaluates their semantic intent against configured compliance policies via the [ramen-ai](https://ramenai.dev) API, and maps the resulting V5 Ed25519-signed receipt onto a TRACE Trust Record (EAT profile -`tag:agentrust.io,2026:trace-v0.1`). +`tag:agentrust-io.com,2026:trace-v0.2`). Source: [ramen-ai-dev/ramen-ai-integrations — plugins/cmcp-python](https://github.com/ramen-ai-dev/ramen-ai-integrations/tree/master/plugins/cmcp-python) ## Run it -Against released packages (`agentrust-trace` 0.3.0, `cmcp-runtime` 0.3.0): +Against released packages (`agentrust-trace` >= 0.5, `agentrust-trace-tests` >= 0.4): ```bash pip install agentrust-trace agentrust-trace-tests cmcp-runtime diff --git a/integrations/ramen-ai-cmcp/pyproject.toml b/integrations/ramen-ai-cmcp/pyproject.toml index d3212b8..205443e 100644 --- a/integrations/ramen-ai-cmcp/pyproject.toml +++ b/integrations/ramen-ai-cmcp/pyproject.toml @@ -8,7 +8,7 @@ version = "0.1.0" description = "ramen-ai cMCP policy adapter and TRACE Trust Record mapper" requires-python = ">=3.11" license = "MIT" -dependencies = ["agentrust-trace"] +dependencies = ["agentrust-trace>=0.5"] [project.optional-dependencies] test = ["pytest"] diff --git a/integrations/ramen-ai-cmcp/ramen_ai_trace.py b/integrations/ramen-ai-cmcp/ramen_ai_trace.py index 6e08d32..4786dc1 100644 --- a/integrations/ramen-ai-cmcp/ramen_ai_trace.py +++ b/integrations/ramen-ai-cmcp/ramen_ai_trace.py @@ -1,7 +1,7 @@ """ramen_ai_trace — TRACE Trust Record mapper for ramen-ai V5 receipts. Maps a ramen-ai V5 Ed25519 receipt onto a TRACE Trust Record dict -(EAT profile tag:agentrust.io,2026:trace-v0.1). +(EAT profile tag:agentrust-io.com,2026:trace-v0.2). This is the self-contained copy for the agentrust-io/integrations submission. The canonical implementation lives at: @@ -11,7 +11,7 @@ ───────────── TRACE field ← ramen-ai V5 source ────────────────────────────────────────────────────────────── -eat_profile constant "tag:agentrust.io,2026:trace-v0.1" +eat_profile constant "tag:agentrust-io.com,2026:trace-v0.2" iat caller-supplied (int, Unix seconds) subject "spiffe://ramenai.dev/evaluation/" cnf.jwk caller-supplied (public JWK for signing) @@ -36,7 +36,7 @@ import json from typing import Any -EAT_PROFILE = "tag:agentrust.io,2026:trace-v0.1" +EAT_PROFILE = "tag:agentrust-io.com,2026:trace-v0.2" VERIFIER = "ramen-ai-core" diff --git a/integrations/ramen-ai-cmcp/tests/test_mapping.py b/integrations/ramen-ai-cmcp/tests/test_mapping.py index 5e0698e..26cc8f2 100644 --- a/integrations/ramen-ai-cmcp/tests/test_mapping.py +++ b/integrations/ramen-ai-cmcp/tests/test_mapping.py @@ -43,7 +43,7 @@ def record(): # ── field mapping ─────────────────────────────────────────────────────────── def test_eat_profile(record): - assert record["eat_profile"] == "tag:agentrust.io,2026:trace-v0.1" + assert record["eat_profile"] == "tag:agentrust-io.com,2026:trace-v0.2" def test_subject_is_spiffe_uri(record): From 90dcbbbb009aee757bdefba78213a363aa6fa81a Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 3 Aug 2026 09:32:21 -0700 Subject: [PATCH 2/2] fix(ramen-ai-cmcp): record the verified agentrust-trace version `tested_against.agentrust-trace` still read 0.3.0, which is the same staleness as the profile constant. Set to 0.5.1, the version the mapping tests and the level 0 conformance run were actually verified against here. `cmcp-runtime` is left at 0.3.0 deliberately: this change did not exercise it, and the field records what the integration was last tested against rather than what is current. Co-Authored-By: Claude Opus 5 (1M context) --- integrations/ramen-ai-cmcp/integration.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integrations/ramen-ai-cmcp/integration.yaml b/integrations/ramen-ai-cmcp/integration.yaml index 55e2c7f..415bbfb 100644 --- a/integrations/ramen-ai-cmcp/integration.yaml +++ b/integrations/ramen-ai-cmcp/integration.yaml @@ -18,5 +18,5 @@ tier: community # the gradable record and verifies via agentrust_trace.verify_record. trace_conformance_level: 0 tested_against: - agentrust-trace: "0.3.0" + agentrust-trace: "0.5.1" cmcp-runtime: "0.3.0"