integrations/aeoess-aps: add APS PolicyDecision to TRACE Level 0 mapping

[aeoess]

Relates to #46.

What this adds

A Community-tier integration mapping one signed APS policy decision onto a TRACE v0.2 Trust Record.

The scope is deliberately narrow:

• one APS policy decision in, one TRACE Trust Record out
• TRACE conformance Level 0 only
• no ActionReceipt mapping
• no revocation mapping
• no identity or delegation binding
• no outcome or attribution mapping

The adapter verifies the APS decision signature and expiry before mapping, and refuses a decision that fails either. The example writes an unsigned record for the Level 0 runner and a signed sidecar verified with agentrust_trace.verify_record.

Versions

Built from upstream 4bcb30bbaec8f88fc232bc9e710e5edae453b25f. Tested with agent-passport-system==2.10.0, agentrust-trace==0.5.1, agentrust-trace-tests==0.4.1, profile tag:agentrust-io.com,2026:trace-v0.2.

Conformance result

TRACE Conformance Report -- Level 0
Format : trace
Record : trust-record.jwt

  TR-ENV  PASS        eat_profile sentinel matches
  TR-ENV  PASS        iat is valid and fresh (1785785207)
  TR-ENV  PASS        subject is a valid workload identity URI ('spiffe://agent-passport.org/evaluator/eval_example/decision/pdec_c0ae78e7a19c')
  TR-ENV  PASS        cnf.jwk.kty present ('OKP')
  TR-SIG  PASS        cnf.jwk key type is supported (kty='OKP', crv='Ed25519')
  TR-SIG  UNVERIFIED  TR-SIG-005: no signature present; this record is NOT cryptographically verified
  TR-POL  PASS        policy.bundle_hash has valid digest format
  TR-POL  PASS        policy.enforcement_mode is valid ('enforce')

Result: PASS  (8 checks, 0 skipped, 1 UNVERIFIED -- record is NOT cryptographically verified)

Integration tests: 26 passed.

Reproduction

python -m pip install --upgrade pip
pip install agentrust-trace agentrust-trace-tests agent-passport-system
pip install -e "integrations/aeoess-aps[test]"

pytest integrations/aeoess-aps/tests -q

python integrations/aeoess-aps/examples/emit_record.py --out trust-record.jwt

trace-tests verify --record trust-record.jwt --level 0

The example also writes trust-record.jwt.signed.json, which verifies through agentrust_trace.verify_record.

Build findings

Two released-package details differed from what was recorded in #46.

agentrust-trace==0.5.1 does not expose a revocation= argument on verify_record. The signature is (record, public_key_or_jwk=None, *, allow_embedded_key=False, max_age_seconds=86400, expected_nonce=None). Revocation is out of scope here regardless, but the follow-up will need a different hook.

agentrust-trace-tests==0.4.1 accepts a plain record carrying a top-level signature and verifies it. loader.py allows a bare signature key explicitly, and running the signed sidecar through Level 0 returns a verified TR-SIG result rather than UNVERIFIED. This PR still grades the unsigned record and keeps the signed form beside it, matching the current merged integration pattern in ramen-ai-cmcp and spendguard. The signed run was a diagnostic only and changed nothing in the submission. Happy to switch which artifact is graded if you would rather the catalogue showed the stronger result.

Deliberately absent fields

model, data_class and build_provenance are required by the v0.2 schema and are absent. An APS policy decision carries no model identity, no data classification and no build provenance, and inventing values would be worse than the gap. tests/test_mapping.py pins the exact absent set so it cannot widen silently.

What this does not claim

• no conformance above Level 0
• not a schema-complete mapping of every TRACE field
• runtime.platform is software-only, which is not hardware or runtime attestation
• the ephemeral TRACE signing key does not chain to a trusted issuer
• no transparency-log inclusion
• no revocation enforcement
• no identity or delegation interoperability

Those need separate mappings or upstream work.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[imran-siddique]

Reviewed the adapter, the tests, and the conformance workflow. This is the shape a Community-tier integration should have.

What makes it acceptable:

• The APS evaluator signature and expiry are verified before any mapping happens, and a decision that fails either raises instead of producing a record. That is the important property: an unverified decision cannot become a record that looks appraised.
• The two signatures are kept clearly separate, and the module never applies the TRACE signature itself.
• The gap is declared rather than papered over. model, data_class and build_provenance are required by the v0.2 schema and absent here because an APS decision carries none of them, and tests/test_mapping.py pins the exact absent set so the gap cannot drift silently. integration.yaml states Level 0 and the TR-SIG-005 UNVERIFIED finding openly.
• narrow mapping to EAR warning is a defensible reading, since TRACE has no narrow and warning is the status for an appraisal that affirms with reservations.
• Versions are pinned and the upstream commit is named.

One housekeeping item: the CodeQL alert on this PR (py/incomplete-url-substring-sanitization, alert 85, tests/test_mapping.py:106) is a false positive. Line 106 builds an expected SPIFFE URI for an exact-equality assertion, so there is no substring sanitization to be incomplete. No code change needed. It should be dismissed as a false positive so the repo alert list stays meaningful.

Approving. Leaving the merge to Imran.

[aeoess]

Thanks for the careful review.

Small note on alert 85: it was raised against c3382cd, where the test used a prefix assertion plus two substring checks. I addressed it in f5295149 by constructing the full expected SPIFFE URI and asserting exact equality, which is why the current line looks safe and CodeQL is green.

So the alert was resolved by the follow-up commit rather than needing a false-positive dismissal. Appreciate the approval.