diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 6af8861..54ce87c 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -8,7 +8,7 @@ labels: bug
 <!-- Describe the problem. Quote the specific text or schema path. -->
 
 **Spec section or file**
-<!-- e.g. spec/trace-v0.1.md §3.2.1, schema/trace-claim.json #/properties/runtime -->
+<!-- e.g. spec/trace-v0.2.md §3.2.1, schema/trace-claim.json #/properties/runtime -->
 
 **Expected behavior**
 <!-- What should it say or do? -->
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 5dd2342..0e6f31e 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -12,7 +12,7 @@
 
 ## Spec section
 
-<!-- Which section(s) of spec/trace-v0.1.md does this affect? -->
+<!-- Which section(s) of spec/trace-v0.2.md does this affect? -->
 
 ## Checklist
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f20a29..50cb6d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,18 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR.
 
 ## [Unreleased]
 
+### Changed
+
+- **BREAKING: TRACE v0.2 changes the EAT profile URI to `tag:agentrust-io.com,2026:trace-v0.2`** (was `tag:agentrust.io,2026:trace-v0.1`). `agentrust.io` was never a domain this project controlled; it resolves to third-party parked addresses. RFC 4151 permits a tag URI only where the minting authority controlled the named domain on the stated date, so the v0.1 identifier was invalid rather than merely misspelled: it asserted authority over a name someone else could stand up a conflicting definition at.
+
+  **Cutover, not coexistence.** A v0.2 verifier requires the new URI and rejects the old one; it does not accept both. Dual acceptance would keep the invalid identifier live indefinitely, which is the thing being fixed. Records already issued under v0.1 stay verifiable against `spec/trace-v0.1.md` and the published `agentrust-trace` 0.4.x releases, which remain on PyPI. They are v0.1 records and are read as such.
+
+  Nothing else in the record format changed. No field was added, removed, or re-typed, so migration for a producer is the profile string and a dependency bump.
+
+  Moved together: `spec/trace-v0.2.md` (new, with a "Changes from v0.1" section), `spec/trace-v0.1.md` (retained, marked superseded), the root `schema/trace-claim.json` const, the packaged `agentrust_trace/schema/trace-v0.2.json`, the `eat_profile` `Literal` in `models.py`, the AGT adapter, `validate.py`'s schema resource, the four platform example records, and the docs.
+
+- Other `agentrust.io` URLs moved to `agentrust-io.com`: the registry and verifier hosts in the AGT adapter and the schema `$id`.
+
 ## [0.4.0]
 
 ### Added
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 482ffdb..05a05d8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -16,7 +16,7 @@ This adds `Signed-off-by: Your Name <you@example.com>`. PRs without DCO sign-off
 
 ### Spec changes (normative text)
 
-Changes to `spec/trace-v0.1.md` that affect what implementations must do.
+Changes to `spec/trace-v0.2.md` that affect what implementations must do.
 
 1. Open a GitHub issue using the **Spec change proposal** template. Describe the problem, the proposed change, and the spec section affected.
 2. Allow 5 business days for comment. Changes touching wire format, cryptographic algorithms, or Trust Record required fields require 14 days.
diff --git a/README.md b/README.md
index 22d433c..040078b 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 </p>
 
 <p align="center">
-  <a href="spec/trace-v0.1.md">Specification</a> &nbsp;|&nbsp;
+  <a href="spec/trace-v0.2.md">Specification</a> &nbsp;|&nbsp;
   <a href="schema/trace-claim.json">Schema</a> &nbsp;|&nbsp;
   <a href="examples/">Examples</a> &nbsp;|&nbsp;
   <a href="https://github.com/agentrust-io/trace-registry">Registry</a> &nbsp;|&nbsp;
@@ -20,7 +20,7 @@
 </p>
 
 [![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
-[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.1.md)
+[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.2.md)
 [![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/)
 [![CI](https://github.com/agentrust-io/trace-spec/actions/workflows/ci.yml/badge.svg)](https://github.com/agentrust-io/trace-spec/actions/workflows/ci.yml)
 [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white&style=flat)](https://discord.gg/grgzFEHgkj)
@@ -54,7 +54,7 @@ signed = sign_record(record, key=signing_key)
 | | |
 |---|---|
 | 📖 Full documentation | [trace.agentrust-io.com](https://trace.agentrust-io.com) |
-| 📄 Specification | [spec/trace-v0.1.md](spec/trace-v0.1.md) |
+| 📄 Specification | [spec/trace-v0.2.md](spec/trace-v0.2.md) |
 | 🔍 Schema | [schema/trace-claim.json](schema/trace-claim.json) |
 | 📦 PyPI | [agentrust-trace](https://pypi.org/project/agentrust-trace/) |
 | 🧪 Test suite | [trace-tests](https://github.com/agentrust-io/trace-tests) |
@@ -91,7 +91,7 @@ TRACE is the evidence format. AGT and cMCP produce and consume Trust Records, so
 
 ### What is the current status of TRACE?
 
-The current specification is TRACE v0.1, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.
+The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.
 
 <script type="application/ld+json">
 {
@@ -143,7 +143,7 @@ The current specification is TRACE v0.1, published with a conformance test suite
       "name": "What is the current status of TRACE?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "The current specification is TRACE v0.1, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production."
+        "text": "The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production."
       }
     }
   ]
diff --git a/docs/crosswalks/owasp-agentic-top-10.md b/docs/crosswalks/owasp-agentic-top-10.md
index cb60cd5..a31633e 100644
--- a/docs/crosswalks/owasp-agentic-top-10.md
+++ b/docs/crosswalks/owasp-agentic-top-10.md
@@ -1,6 +1,6 @@
 # OWASP Agentic AI Top 10 Evidence Cross-walk
 
-> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.1 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.1 Trust Record as defined in [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md).
+> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.2 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.2 Trust Record as defined in [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md).
 
 ---
 
@@ -8,9 +8,9 @@
 
 OWASP's Agentic AI Top 10 (ASI01–ASI10) names the principal risk categories for autonomous AI agents. TRACE is an evidence and attestation layer: it does not prevent these risks, but it produces verifiable, hardware-rooted records that support audit, incident review, and governance verification after or during execution.
 
-This page answers a concrete question for each OWASP risk: which TRACE Trust Record claims carry relevant evidence, what that evidence actually proves, and where TRACE v0.1 leaves a gap that a future profile would need to close.
+This page answers a concrete question for each OWASP risk: which TRACE Trust Record claims carry relevant evidence, what that evidence actually proves, and where TRACE v0.2 leaves a gap that a future profile would need to close.
 
-Field names are exact TRACE v0.1 claim names as specified in §3.1 of the spec. Sub-field references such as `policy.bundle_hash`, `runtime.platform`, and `appraisal.status` refer to the nested fields shown in the §3.2 wire-format example.
+Field names are exact TRACE v0.2 claim names as specified in §3.1 of the spec. Sub-field references such as `policy.bundle_hash`, `runtime.platform`, and `appraisal.status` refer to the nested fields shown in the §3.2 wire-format example.
 
 ---
 
@@ -23,8 +23,8 @@ Field names are exact TRACE v0.1 claim names as specified in §3.1 of the spec.
 | **ASI03: Identity and Privilege Abuse** | `subject`, `cnf`, `signature`, `runtime`, `policy`, `appraisal` | `subject` carries the SPIFFE SVID binding workload identity to a TEE-held key; `cnf` binds the signing key to the TEE via the hardware measurement in `runtime`; `appraisal.status` records the verifier's judgment of the evidence against policy; `policy.bundle_hash` shows what authorization rules were bound. Together these allow a verifier to confirm that the claimed identity corresponded to a genuine, measured workload at record issuance time. | Does not replace IAM or RBAC systems. Does not prove that external permissions granted to the workload were correctly scoped. Does not cover lateral movement or privilege escalation that occurred at infrastructure layers outside the TEE boundary. | Delegation profile fields for scoped credentials, audience restriction, purpose binding, and per-action authorization evidence. |
 | **ASI04: Agentic Supply Chain Vulnerabilities** | `build_provenance`, `model`, `runtime`, `transparency`, `appraisal` | `build_provenance.slsa_level`, `build_provenance.builder`, and `build_provenance.digest` bind build-time provenance to the running workload; `model.weights_digest` and `model.model_id` bind the model artifact; `runtime.measurement` and `runtime.rim_uri` bind the runtime image to vendor-published Reference Integrity Manifests; `transparency` provides an append-only anchor for the full record. | Does not enumerate every transitive dependency. Does not detect malicious code that was present at build time but is not reflected in measurement divergence. Does not prove model behavior is safe -- only that the identified artifact was the one that executed. | Richer AIBOM/SBOM linkage in the `model` sub-claim; vendor platform annexes specifying per-silicon supply-chain appraisal criteria. |
 | **ASI05: Unexpected Code Execution** | `runtime`, `build_provenance`, `tool_transcript`, `policy`, `appraisal` | `runtime.measurement` shows what workload and container digest were loaded; `build_provenance.digest` and `build_provenance.slsa_level` bind the build artifact; `tool_transcript.hash` captures tool invocations at protocol boundaries; `appraisal.status` records whether the verifier accepted the runtime evidence against current RIMs. | Does not prevent code execution. Does not prove no code ran outside the recorded `tool_transcript` scope: inline code execution embedded in the workload binary is not captured at invocation granularity by v0.1 claims. | Tool and code-execution profile: sandbox identity, command execution transcript hash, filesystem and network boundary evidence per invocation. |
-| **ASI06: Memory and Context Poisoning** | `model`, `data_class`, `tool_transcript`, `build_provenance`, `transparency` | `model.model_id` and `model.weights_digest` identify the model artifact; `data_class` records the sensitivity classification applied to inputs and outputs; `tool_transcript.hash` captures context-retrieval calls that crossed an instrumented boundary; `build_provenance.digest` binds the build artifact that includes any vector-store or RAG client code. | TRACE v0.1 does not bind memory snapshots, RAG corpus roots, embedding-store contents, or poisoning scan results. Context provenance -- where retrieved chunks originated and whether they were validated -- is not a v0.1 claim. | Memory and RAG profile: context source hashes, corpus Merkle roots, poisoning scan status, namespace and tenant boundary evidence. |
-| **ASI07: Insecure Inter-Agent Communication** | `subject`, `cnf`, `signature`, `runtime`, `tool_transcript`, `transparency` | `subject` and `cnf` establish and bind workload identity for each participating agent; `signature` (or the enveloping-signature equivalent) proves record integrity; `runtime.measurement` binds the TEE that produced the record; `tool_transcript.hash` anchors the inter-agent call transcript; `transparency` anchors the record in an append-only log accessible to any verifier. | TRACE v0.1 does not define a normative A2A profile. Message-level semantic validation, nonce binding per message, and delegation chain records across multiple hops are not v0.1 claims. | A2A profile: peer agent identity, per-message hash, audience restriction, nonce, delegation chain, and protocol version binding. |
+| **ASI06: Memory and Context Poisoning** | `model`, `data_class`, `tool_transcript`, `build_provenance`, `transparency` | `model.model_id` and `model.weights_digest` identify the model artifact; `data_class` records the sensitivity classification applied to inputs and outputs; `tool_transcript.hash` captures context-retrieval calls that crossed an instrumented boundary; `build_provenance.digest` binds the build artifact that includes any vector-store or RAG client code. | TRACE v0.2 does not bind memory snapshots, RAG corpus roots, embedding-store contents, or poisoning scan results. Context provenance -- where retrieved chunks originated and whether they were validated -- is not a v0.1 claim. | Memory and RAG profile: context source hashes, corpus Merkle roots, poisoning scan status, namespace and tenant boundary evidence. |
+| **ASI07: Insecure Inter-Agent Communication** | `subject`, `cnf`, `signature`, `runtime`, `tool_transcript`, `transparency` | `subject` and `cnf` establish and bind workload identity for each participating agent; `signature` (or the enveloping-signature equivalent) proves record integrity; `runtime.measurement` binds the TEE that produced the record; `tool_transcript.hash` anchors the inter-agent call transcript; `transparency` anchors the record in an append-only log accessible to any verifier. | TRACE v0.2 does not define a normative A2A profile. Message-level semantic validation, nonce binding per message, and delegation chain records across multiple hops are not v0.1 claims. | A2A profile: peer agent identity, per-message hash, audience restriction, nonce, delegation chain, and protocol version binding. |
 | **ASI08: Cascading Failures** | `tool_transcript`, `transparency`, `subject`, `appraisal`, `policy` | `tool_transcript.hash` and `tool_transcript.call_count` provide a bounded activity record for post-incident traceability; `subject` identifies the workload at each hop where a Trust Record was issued; `appraisal.status` and `appraisal.verifier` record the verification outcome; `policy.bundle_hash` shows what controls were bound; `transparency` provides an auditable anchor for reconstructing the sequence of records. | Does not itself detect cascade conditions, stop propagation, or reconstruct full multi-agent lineage unless every participating agent issued Trust Records and those records are correlated at analysis time. Lineage reconstruction requires out-of-band tooling. | Workflow provenance profile: parent/child record references, propagation lineage identifiers, blast-radius counters, and circuit-breaker event records. |
 | **ASI09: Human-Agent Trust Exploitation** | `tool_transcript`, `policy`, `data_class`, `transparency`, `appraisal` | `tool_transcript.hash` records the set of actions the agent took at protocol boundaries; `policy.bundle_hash` and `policy.enforcement_mode` show what rules were in force; `data_class` records the sensitivity class of data involved; `appraisal.status` provides the verifier's assessment; `transparency` anchors the record for independent audit. Collectively these support a post-incident review of what the agent was authorized to do and what it did. | Does not prove what a human was shown in the UI, whether the explanation was accurate, or whether informed consent was obtained. Does not detect social engineering at the human layer. | HITL (human-in-the-loop) evidence profile: approval record, reviewer identity, hash of displayed risk summary, and human decision evidence bound into the Trust Record. |
 | **ASI10: Rogue Agents** | `subject`, `runtime`, `cnf`, `signature`, `policy`, `tool_transcript`, `appraisal`, `transparency` | The full v0.1 claim set combines hardware-bound identity (`subject`, `cnf`), measured execution environment (`runtime`), policy binding (`policy.bundle_hash`, `policy.enforcement_mode`), tool activity (`tool_transcript`), verifier judgment (`appraisal.status`), and transparency anchoring (`transparency`) into one signed, independently verifiable record. A verifier can confirm that the agent presenting this record ran as a measured, policy-bound workload with a TEE-rooted identity at the stated time. | Does not determine behavioral intent. Does not detect rogue behavior that remained within the boundary of recorded claims. A workload can issue a valid Trust Record and still behave in ways the record does not constrain at inference time. | Behavioral integrity profile: declared capability manifest hash, expected tool set, execution baseline hash, and anomaly or quarantine event records. |
@@ -39,7 +39,7 @@ The table above surfaces per-risk scope boundaries. These apply across all ten r
 
 **TRACE does not adjudicate model behavior.** As stated in §2.4 of the spec, prompt injection, jailbreaks, hallucination, and alignment drift are permanent scope boundaries. TRACE proves what model artifact executed and what countermeasures were bound; it does not evaluate whether the model's output was correct or intended.
 
-**TRACE v0.1 does not cover intra-binary execution.** `tool_transcript` captures invocations crossing an instrumented protocol boundary (MCP, A2A, or equivalent). Code paths executed inside the deployed binary -- including embedded tool dispatch, in-process memory reads, or direct API calls -- are bound only by `build_provenance` and `model`, not at invocation granularity.
+**TRACE v0.2 does not cover intra-binary execution.** `tool_transcript` captures invocations crossing an instrumented protocol boundary (MCP, A2A, or equivalent). Code paths executed inside the deployed binary -- including embedded tool dispatch, in-process memory reads, or direct API calls -- are bound only by `build_provenance` and `model`, not at invocation granularity.
 
 **TRACE does not replace IAM, RBAC, or network controls.** `subject` and `cnf` establish and bind workload identity, but the permissions granted to that identity by external systems are outside the Trust Record. A correctly identified workload can still hold excessive privileges.
 
@@ -60,6 +60,6 @@ The MITRE ATLAS cross-walk (a separate v0.2 item) will address tactics and techn
 ## References
 
 - OWASP Agentic AI Top 10: <https://genai.owasp.org/>
-- TRACE v0.1 specification: [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md)
+- TRACE v0.2 specification: [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md)
 - TRACE roadmap: [`ROADMAP.md`](../../ROADMAP.md)
 - MITRE ATLAS: <https://atlas.mitre.org/>
diff --git a/docs/glossary.md b/docs/glossary.md
index 3492d25..315fb87 100644
--- a/docs/glossary.md
+++ b/docs/glossary.md
@@ -60,7 +60,7 @@ A numeric value (0, 1, or 2) that summarizes the strength of the guarantees carr
 ---
 
 **Trust Record**
-A signed JSON document emitted by an AI agent at the end of a governed session. It asserts the agent's identity, model, policy, data class, tool invocations, and (at Level 1+) hardware attestation state. Defined in full in the [TRACE Specification](../spec/trace-v0.1.md).
+A signed JSON document emitted by an AI agent at the end of a governed session. It asserts the agent's identity, model, policy, data class, tool invocations, and (at Level 1+) hardware attestation state. Defined in full in the [TRACE Specification](../spec/trace-v0.2.md).
 
 ---
 
diff --git a/docs/index.md b/docs/index.md
index 93fd7c6..326f4b9 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -23,9 +23,9 @@ TRACE defines the format, anchoring protocol, and verification rules for cryptog
 
 -   :material-file-document: **Specification**
 
-    The normative TRACE v0.1 specification — envelope format, claim types, signing rules, and verification algorithm.
+    The normative TRACE v0.2 specification — envelope format, claim types, signing rules, and verification algorithm.
 
-    [Read the spec →](../spec/trace-v0.1.md)
+    [Read the spec →](../spec/trace-v0.2.md)
 
 -   :material-connection: **Integration**
 
diff --git a/docs/quickstart.md b/docs/quickstart.md
index 759a6b0..6ba90b1 100644
--- a/docs/quickstart.md
+++ b/docs/quickstart.md
@@ -51,7 +51,7 @@ from agentrust_trace import generate_key, sign_record
 key = generate_key()
 
 record = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()),
     "subject": "spiffe://trust.example.org/agent/my-agent",
     "model": {
@@ -78,7 +78,7 @@ record = {
         "status": "none",
         "verifier": "https://verifier.example.org",
     },
-    "transparency": "https://registry.agentrust.io/claim/placeholder",
+    "transparency": "https://registry.agentrust-io.com/claim/placeholder",
 }
 
 signed = sign_record(record, key)
@@ -103,7 +103,7 @@ from agentrust_trace import load_signing_key, sign_record
 key = load_signing_key()
 
 record = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()),
     "subject": "spiffe://trust.example.org/agent/my-agent",
     "model": {
@@ -130,7 +130,7 @@ record = {
         "status": "none",
         "verifier": "https://verifier.example.org",
     },
-    "transparency": "https://registry.agentrust.io/claim/placeholder",
+    "transparency": "https://registry.agentrust-io.com/claim/placeholder",
 }
 
 signed = sign_record(record, key)
@@ -197,6 +197,6 @@ For TEE-rooted records (AMD SEV-SNP, Intel TDX, NVIDIA H100), use cMCP as the ru
 
 ## Next steps
 
-- [Full Specification](../spec/trace-v0.1.md) — all claims, wire formats, conformance
+- [Full Specification](../spec/trace-v0.2.md) — all claims, wire formats, conformance
 - [Verification Protocol](verification.md) — five-step offline verification
 - [Schema Reference](schema.md) — JSON Schema with field descriptions
diff --git a/docs/schema.md b/docs/schema.md
index d7ae299..0382d60 100644
--- a/docs/schema.md
+++ b/docs/schema.md
@@ -6,7 +6,7 @@ JSON Schema for the TRACE v0.1 Trust Record. Source: [`schema/trace-claim.json`]
 
 | Field | Type | Required | Description |
 |---|---|---|---|
-| `eat_profile` | string | **yes** | EAT profile URI. Must be `tag:agentrust.io,2026:trace-v0.1` |
+| `eat_profile` | string | **yes** | EAT profile URI. Must be `tag:agentrust-io.com,2026:trace-v0.2` |
 | `iat` | integer | **yes** | Issued-at timestamp (Unix epoch seconds) |
 | `subject` | string | **yes** | Workload identity. SPIFFE SVID (`spiffe://`) or DID (`did:`) |
 | `model` | object | **yes** | Model artifact binding |
@@ -131,7 +131,7 @@ TRACE v0.1 supports two wire formats:
 
 ```json
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750676142,
   "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
   "model": {
@@ -164,7 +164,7 @@ TRACE v0.1 supports two wire formats:
     "status": "affirming",
     "verifier": "https://trust-authority.example.org"
   },
-  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:15:42Z",
+  "transparency": "https://registry.agentrust-io.com/claim/trace-2026-06-23T09:15:42Z",
   "cnf": {
     "jwk": { "kty": "EC", "crv": "P-256", "x": "...", "y": "..." }
   },
diff --git a/docs/trust-levels.md b/docs/trust-levels.md
index 7279a95..a95355a 100644
--- a/docs/trust-levels.md
+++ b/docs/trust-levels.md
@@ -26,7 +26,7 @@ Level 0 records are signed with an Ed25519 key held by the agent process. There
 
 ```json
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750000000,
   "subject": "spiffe://trust.example.org/agent/my-agent",
   "model": { "provider": "anthropic", "model_id": "claude-sonnet-4-6", "version": "20251001" },
@@ -35,7 +35,7 @@ Level 0 records are signed with an Ed25519 key held by the agent process. There
   "data_class": "internal",
   "build_provenance": { "slsa_level": 1, "digest": "sha256:e5f6..." },
   "appraisal": { "status": "none", "verifier": "https://verifier.example.org" },
-  "transparency": "https://registry.agentrust.io/claim/placeholder",
+  "transparency": "https://registry.agentrust-io.com/claim/placeholder",
   "cnf": { "jwk": { "kty": "OKP", "crv": "Ed25519", "x": "<base64url>" } },
   "signature": "<base64url>"
 }
@@ -113,6 +113,6 @@ Relying parties set the minimum acceptable level in their Cedar policy. Records
 ## Related
 
 - [Trust Levels in the test suite](https://tests.agentrust-io.com/levels)
-- [TRACE Specification — Section 4: Trust Levels](../spec/trace-v0.1.md)
+- [TRACE Specification — Section 4: Trust Levels](../spec/trace-v0.2.md)
 - [Hardware Attestation Platforms](tutorials/hardware-attestation-platforms.md)
 - [Glossary](glossary.md)
diff --git a/docs/tutorials/agt-adapter.md b/docs/tutorials/agt-adapter.md
index 7e26054..8f30d76 100644
--- a/docs/tutorials/agt-adapter.md
+++ b/docs/tutorials/agt-adapter.md
@@ -41,7 +41,7 @@ measurement = "sha256:" + hashlib.sha256(chain_tip.encode()).hexdigest()
 
 # Build the record manually
 record = TrustRecord(
-    eat_profile="tag:agentrust.io,2026:trace-v0.1",
+    eat_profile="tag:agentrust-io.com,2026:trace-v0.2",
     iat=int(time.time()),
     subject=agent_did,
     model=ModelInfo(provider="anthropic", model_id="claude-sonnet-4-6", version="20251001"),
@@ -50,8 +50,8 @@ record = TrustRecord(
     data_class="confidential",
     tool_transcript=ToolTranscript(hash=transcript_hash, call_count=len(audit_entries)),
     build_provenance=BuildProvenance(slsa_level=2, digest="sha256:e5f6..."),
-    appraisal=Appraisal(status="affirming", verifier="https://agentrust.io/verify"),
-    transparency="https://registry.agentrust.io/claim/...",
+    appraisal=Appraisal(status="affirming", verifier="https://agentrust-io.com/verify"),
+    transparency="https://registry.agentrust-io.com/claim/...",
     cnf=ConfirmationKey(jwk=JWK(kty="OKP", crv="Ed25519", x="...")),
 )
 ```
@@ -73,7 +73,7 @@ adapter = TraceAGTAdapter(
     model_id="claude-sonnet-4-6",
     model_version="20251001",
     build_provenance_digest="sha256:e5f6a7b8...",
-    transparency="https://registry.agentrust.io/claim/...",
+    transparency="https://registry.agentrust-io.com/claim/...",
 )
 
 # 2. Collect AGT session data after govern_fn.close_session()
diff --git a/docs/tutorials/anchoring-to-the-registry.md b/docs/tutorials/anchoring-to-the-registry.md
index ead0f9e..9e48050 100644
--- a/docs/tutorials/anchoring-to-the-registry.md
+++ b/docs/tutorials/anchoring-to-the-registry.md
@@ -31,7 +31,7 @@ It holds the canonical URI of the registry entry — the URL at which any verifi
 Example value from the spec:
 
 ```
-https://registry.agentrust.io/claim/trace-2026-06-23T09:15:42Z-f2a8d1
+https://registry.agentrust-io.com/claim/trace-2026-06-23T09:15:42Z-f2a8d1
 ```
 
 ---
@@ -47,7 +47,7 @@ from agentrust_trace.sign import generate_key, sign_record
 key = generate_key()
 
 record = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()),
     "subject": "spiffe://example.org/agent/my-agent",
     "model": {
diff --git a/docs/tutorials/hardware-attestation-platforms.md b/docs/tutorials/hardware-attestation-platforms.md
index 853dcc4..8f2eda7 100644
--- a/docs/tutorials/hardware-attestation-platforms.md
+++ b/docs/tutorials/hardware-attestation-platforms.md
@@ -46,7 +46,7 @@ from agentrust_trace import generate_key, sign_record
 key = generate_key()
 
 record = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()),
     "subject": "spiffe://dev.example.org/agent/local-test",
     "runtime": {
diff --git a/docs/tutorials/signing-your-first-trust-record.md b/docs/tutorials/signing-your-first-trust-record.md
index 896c555..47b0539 100644
--- a/docs/tutorials/signing-your-first-trust-record.md
+++ b/docs/tutorials/signing-your-first-trust-record.md
@@ -53,7 +53,7 @@ Every TRACE Trust Record requires these top-level fields. There are no optional
 import time
 
 record = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()),
     "subject": "spiffe://trust.example.org/agent/my-agent",
     "model": {
@@ -78,7 +78,7 @@ record = {
         "status": "none",
         "verifier": "https://verifier.example.org",
     },
-    "transparency": "https://registry.agentrust.io/claim/placeholder",
+    "transparency": "https://registry.agentrust-io.com/claim/placeholder",
 }
 ```
 
diff --git a/docs/tutorials/verifying-a-trust-record.md b/docs/tutorials/verifying-a-trust-record.md
index efc5d37..ce6595e 100644
--- a/docs/tutorials/verifying-a-trust-record.md
+++ b/docs/tutorials/verifying-a-trust-record.md
@@ -127,7 +127,7 @@ Run schema validation before trusting any claims in the record. A record that pa
 Every TRACE record carries an `eat_profile` field that identifies the spec version. Reject records with an unexpected profile before parsing their claims:
 
 ```python
-EXPECTED_PROFILE = "tag:agentrust.io,2026:trace-v0.1"
+EXPECTED_PROFILE = "tag:agentrust-io.com,2026:trace-v0.2"
 
 if record.get("eat_profile") != EXPECTED_PROFILE:
     raise ValueError(f"unexpected eat_profile: {record.get('eat_profile')!r}")
@@ -222,7 +222,7 @@ def verify_trust_record(path: str, trusted_jwk: dict) -> dict:
         raise RuntimeError(f"record malformed: {e}")
 
     # 3. Profile check
-    if record.get("eat_profile") != "tag:agentrust.io,2026:trace-v0.1":
+    if record.get("eat_profile") != "tag:agentrust-io.com,2026:trace-v0.2":
         raise ValueError(f"unexpected eat_profile: {record.get('eat_profile')!r}")
 
     # 4. Appraisal
diff --git a/docs/verification.md b/docs/verification.md
index 62629dd..6a6bbc4 100644
--- a/docs/verification.md
+++ b/docs/verification.md
@@ -4,7 +4,7 @@ TRACE Trust Records are independently verifiable offline — no call to the issu
 
 ## Five-step verification
 
-This is the normative protocol from [§3.3 of the spec](../spec/trace-v0.1.md).
+This is the normative protocol from [§3.3 of the spec](../spec/trace-v0.2.md).
 
 ### Step 1 — Parse the envelope
 
@@ -49,7 +49,7 @@ print("✓ Signature valid")
 ### Step 4 — Check the EAT profile
 
 ```python
-assert record["eat_profile"] == "tag:agentrust.io,2026:trace-v0.1", "Unknown profile"
+assert record["eat_profile"] == "tag:agentrust-io.com,2026:trace-v0.2", "Unknown profile"
 print("✓ eat_profile correct")
 ```
 
diff --git a/examples/action-receipts/README.md b/examples/action-receipts/README.md
index 0ab915b..66d0a0f 100644
--- a/examples/action-receipts/README.md
+++ b/examples/action-receipts/README.md
@@ -6,7 +6,7 @@ only: the JSON snippets are not TRACE Trust Records and are not validated by
 `schema/trace-claim.json`.
 
 The examples exercise the boundary from
-[spec section 3.3.2](../../spec/trace-v0.1.md#332-action-receipts-for-embodied-workflows-informative):
+[spec section 3.3.2](../../spec/trace-v0.2.md#332-action-receipts-for-embodied-workflows-informative):
 
 1. session evidence verifies the Trust Record and committed transcript;
 2. action issuance evidence verifies that a consequential action request was
diff --git a/examples/amd-sev-snp.json b/examples/amd-sev-snp.json
index 35a627d..8750d0a 100644
--- a/examples/amd-sev-snp.json
+++ b/examples/amd-sev-snp.json
@@ -1,12 +1,12 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750676142,
   "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
   "model": {
     "provider": "anthropic",
     "model_id": "claude-sonnet-4-6",
     "version": "20251001",
-    "aibom_uri": "https://registry.agentrust.io/aibom/claude-sonnet-4-6-20251001"
+    "aibom_uri": "https://registry.agentrust-io.com/aibom/claude-sonnet-4-6-20251001"
   },
   "runtime": {
     "platform": "amd-sev-snp",
@@ -19,13 +19,13 @@
     "bundle_hash": "sha256:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
     "enforcement_mode": "enforce",
     "version": "1.2.0",
-    "policy_uri": "https://registry.agentrust.io/policy/payments-v1.2.0"
+    "policy_uri": "https://registry.agentrust-io.com/policy/payments-v1.2.0"
   },
   "data_class": "confidential",
   "tool_transcript": {
     "hash": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
     "call_count": 3,
-    "transcript_uri": "https://registry.agentrust.io/transcript/amd-2026-06-23T09:15:42Z"
+    "transcript_uri": "https://registry.agentrust-io.com/transcript/amd-2026-06-23T09:15:42Z"
   },
   "build_provenance": {
     "slsa_level": 2,
@@ -39,7 +39,7 @@
     "policy_ref": "https://trust-authority.example.org/policy/sev-snp-agent-v1",
     "timestamp": 1750676145
   },
-  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:15:42Z-f2a8d1",
+  "transparency": "https://registry.agentrust-io.com/claim/trace-2026-06-23T09:15:42Z-f2a8d1",
   "cnf": {
     "jwk": {
       "kty": "EC",
diff --git a/examples/intel-tdx.json b/examples/intel-tdx.json
index debfa4d..56a2fb7 100644
--- a/examples/intel-tdx.json
+++ b/examples/intel-tdx.json
@@ -1,5 +1,5 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750676200,
   "subject": "spiffe://trust.example.org/agent/document-processor/staging",
   "model": {
@@ -7,7 +7,7 @@
     "model_id": "llama-3.3-70b-instruct",
     "version": "3.3",
     "weights_digest": "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
-    "aibom_uri": "https://registry.agentrust.io/aibom/llama-3.3-70b-20260101"
+    "aibom_uri": "https://registry.agentrust-io.com/aibom/llama-3.3-70b-20260101"
   },
   "runtime": {
     "platform": "intel-tdx",
@@ -20,13 +20,13 @@
     "bundle_hash": "sha256:c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
     "enforcement_mode": "enforce",
     "version": "2.0.1",
-    "policy_uri": "https://registry.agentrust.io/policy/document-v2.0.1"
+    "policy_uri": "https://registry.agentrust-io.com/policy/document-v2.0.1"
   },
   "data_class": "internal",
   "tool_transcript": {
     "hash": "sha256:f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7",
     "call_count": 7,
-    "transcript_uri": "https://registry.agentrust.io/transcript/tdx-2026-06-23T09:16:40Z"
+    "transcript_uri": "https://registry.agentrust-io.com/transcript/tdx-2026-06-23T09:16:40Z"
   },
   "build_provenance": {
     "slsa_level": 3,
@@ -40,7 +40,7 @@
     "policy_ref": "https://api.trustedservices.intel.com/policy/tdx-agent-v1",
     "timestamp": 1750676203
   },
-  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:16:40Z-a9b0c1",
+  "transparency": "https://registry.agentrust-io.com/claim/trace-2026-06-23T09:16:40Z-a9b0c1",
   "cnf": {
     "jwk": {
       "kty": "EC",
diff --git a/examples/nvidia-h100.json b/examples/nvidia-h100.json
index 3a28a4d..9692a2e 100644
--- a/examples/nvidia-h100.json
+++ b/examples/nvidia-h100.json
@@ -1,5 +1,5 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750676300,
   "subject": "spiffe://trust.example.org/agent/image-analysis/prod",
   "model": {
@@ -7,7 +7,7 @@
     "model_id": "claude-opus-4-8",
     "version": "20260601",
     "weights_digest": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
-    "aibom_uri": "https://registry.agentrust.io/aibom/claude-opus-4-8-20260601"
+    "aibom_uri": "https://registry.agentrust-io.com/aibom/claude-opus-4-8-20260601"
   },
   "runtime": {
     "platform": "nvidia-h100",
@@ -20,13 +20,13 @@
     "bundle_hash": "sha256:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
     "enforcement_mode": "enforce",
     "version": "1.0.0",
-    "policy_uri": "https://registry.agentrust.io/policy/image-analysis-v1.0.0"
+    "policy_uri": "https://registry.agentrust-io.com/policy/image-analysis-v1.0.0"
   },
   "data_class": "restricted",
   "tool_transcript": {
     "hash": "sha256:a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8",
     "call_count": 1,
-    "transcript_uri": "https://registry.agentrust.io/transcript/h100-2026-06-23T09:18:20Z"
+    "transcript_uri": "https://registry.agentrust-io.com/transcript/h100-2026-06-23T09:18:20Z"
   },
   "build_provenance": {
     "slsa_level": 2,
@@ -40,7 +40,7 @@
     "policy_ref": "https://nras.nvidia.com/policy/h100-cc-agent-v1",
     "timestamp": 1750676304
   },
-  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:18:20Z-b2c3d4",
+  "transparency": "https://registry.agentrust-io.com/claim/trace-2026-06-23T09:18:20Z-b2c3d4",
   "cnf": {
     "jwk": {
       "kty": "EC",
diff --git a/examples/tpm2.json b/examples/tpm2.json
index a1d192a..88693c0 100644
--- a/examples/tpm2.json
+++ b/examples/tpm2.json
@@ -1,5 +1,5 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750676200,
   "subject": "spiffe://trust.example.org/agent/document-processor/staging",
   "model": {
@@ -7,12 +7,12 @@
     "model_id": "llama-3.3-70b-instruct",
     "version": "3.3",
     "weights_digest": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
-    "aibom_uri": "https://registry.agentrust.io/aibom/llama-3.3-70b-20260101"
+    "aibom_uri": "https://registry.agentrust-io.com/aibom/llama-3.3-70b-20260101"
   },
   "runtime": {
     "platform": "tpm2",
     "measurement": "sha256:3b4c2a1f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b",
-    "rim_uri": "https://registry.agentrust.io/rim/tpm2-agent-v1",
+    "rim_uri": "https://registry.agentrust-io.com/rim/tpm2-agent-v1",
     "firmware_version": "7.85",
     "nonce": "dHBtLXdvcmtsb2FkLW5vbmNl"
   },
@@ -20,13 +20,13 @@
     "bundle_hash": "sha256:7d4e2f1a8c3b9e6d0f5a2c7b4e1d8f3a6c9b2e5d0f7a4c1b8e3d6f9a2c5b8e1d",
     "enforcement_mode": "enforce",
     "version": "2.0.1",
-    "policy_uri": "https://registry.agentrust.io/policy/document-v2.0.1"
+    "policy_uri": "https://registry.agentrust-io.com/policy/document-v2.0.1"
   },
   "data_class": "internal",
   "tool_transcript": {
     "hash": "sha256:2c5a8e1d4f7b0c3e6a9d2f5b8e1c4a7d0f3b6e9c2a5d8f1b4e7c0a3d6f9b2e5a",
     "call_count": 7,
-    "transcript_uri": "https://registry.agentrust.io/transcript/tpm2-2026-06-23T09:16:40Z"
+    "transcript_uri": "https://registry.agentrust-io.com/transcript/tpm2-2026-06-23T09:16:40Z"
   },
   "build_provenance": {
     "slsa_level": 3,
@@ -37,10 +37,10 @@
   "appraisal": {
     "status": "affirming",
     "verifier": "https://www.microsoft.com/pkiops/certs/tpm",
-    "policy_ref": "https://registry.agentrust.io/policy/tpm2-appraisal-v1",
+    "policy_ref": "https://registry.agentrust-io.com/policy/tpm2-appraisal-v1",
     "timestamp": 1750676203
   },
-  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:16:40Z-tpm2-b0c1d2",
+  "transparency": "https://registry.agentrust-io.com/claim/trace-2026-06-23T09:16:40Z-tpm2-b0c1d2",
   "cnf": {
     "jwk": {
       "kty": "OKP",
diff --git a/mkdocs.yml b/mkdocs.yml
index c53e978..8be9983 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -89,7 +89,7 @@ plugins:
           - docs/verification.md
           - docs/glossary.md
         Specification:
-          - spec/trace-v0.1.md
+          - spec/trace-v0.2.md
           - docs/schema.md
         Integration:
           - docs/integration/agt.md
@@ -188,7 +188,7 @@ nav:
       - Integration with cMCP: docs/tutorials/integrating-with-cmcp.md
       - Anchor to the registry: docs/tutorials/anchoring-to-the-registry.md
       - Verify the tool transcript: docs/tutorials/verifying-the-audit-chain.md
-  - Specification: spec/trace-v0.1.md
+  - Specification: spec/trace-v0.2.md
   - Integration:
       - AGT: docs/integration/agt.md
       - cMCP: docs/integration/cmcp.md
diff --git a/pyproject.toml b/pyproject.toml
index e0d9813..442f193 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-trace"
-version = "0.4.0"
+version = "0.5.0"
 description = "TRACE v0.1 — hardware-attested governance records for AI agents"
 readme = "README.md"
 license = { text = "Apache-2.0" }
diff --git a/schema/trace-claim.json b/schema/trace-claim.json
index 4ab2a8a..c023e2f 100644
--- a/schema/trace-claim.json
+++ b/schema/trace-claim.json
@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://agentrust.io/schema/trace-v0.1.json",
+  "$id": "https://agentrust-io.com/schema/trace-v0.1.json",
   "title": "TRACE Trust Record",
-  "description": "A TRACE v0.1 Trust Record — hardware-attested governance evidence for an AI agent execution.",
+  "description": "A TRACE v0.2 Trust Record — hardware-attested governance evidence for an AI agent execution.",
   "type": "object",
   "required": [
     "eat_profile",
@@ -20,8 +20,8 @@
   "properties": {
     "eat_profile": {
       "type": "string",
-      "const": "tag:agentrust.io,2026:trace-v0.1",
-      "description": "EAT profile URI identifying this as a TRACE v0.1 Trust Record."
+      "const": "tag:agentrust-io.com,2026:trace-v0.2",
+      "description": "EAT profile URI identifying this as a TRACE v0.2 Trust Record."
     },
     "iat": {
       "type": "integer",
diff --git a/spec/trace-v0.1.md b/spec/trace-v0.1.md
index 332d846..e54d49a 100644
--- a/spec/trace-v0.1.md
+++ b/spec/trace-v0.1.md
@@ -1,3 +1,5 @@
+> **Superseded by [TRACE v0.2](trace-v0.2.md).** The profile URI in this document, `tag:agentrust.io,2026:trace-v0.1`, names a domain this project does not control and is invalid under RFC 4151. v0.2 corrects it to `tag:agentrust-io.com,2026:trace-v0.2` and changes nothing else. This document is retained so records already issued under it stay readable; do not implement it for new work.
+
 # TRACE Specification — Trust, Runtime Attestation, and Compliance Evidence
 
 | Field | Value |
diff --git a/spec/trace-v0.2.md b/spec/trace-v0.2.md
new file mode 100644
index 0000000..21eb2d5
--- /dev/null
+++ b/spec/trace-v0.2.md
@@ -0,0 +1,486 @@
+# TRACE Specification — Trust, Runtime Attestation, and Compliance Evidence
+
+| Field | Value |
+|---|---|
+| Version | 0.2 — Draft |
+| Status | RFC — Request for Comments |
+| Authors | Rishabh Poddar, Aaron Fulkerson (OPAQUE Systems) |
+| Target announcement | Confidential Computing Summit, San Francisco — 23 June 2026 |
+| Reference implementation | [agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP |
+| License | CC BY 4.0 |
+
+> **Note:** This is a pre-ratification draft. Fields, wire formats, and conformance requirements are subject to change before v1.0. Send feedback to: open an issue on this repository.
+
+## Changes from v0.1
+
+One normative change, and it is breaking.
+
+**The EAT profile URI is now `tag:agentrust-io.com,2026:trace-v0.2`** (was `tag:agentrust.io,2026:trace-v0.1`).
+
+`agentrust.io` was never a domain this project controlled; it resolves to third-party parked addresses. RFC 4151 permits a tag URI only where the minting authority controlled the named domain on the stated date, so the v0.1 identifier was not merely misspelled, it was invalid: it asserted authority over a name belonging to someone else, who could at any point stand up a conflicting definition at it.
+
+Everything else in this document is unchanged from v0.1. No field was added, removed, or re-typed.
+
+**Cutover, not coexistence.** A v0.2 verifier MUST require `tag:agentrust-io.com,2026:trace-v0.2` and MUST reject the v0.1 identifier. It MUST NOT accept both. A dual-accepting verifier would leave the invalid identifier live indefinitely, which is the thing being fixed, and would let a record minted under a domain we do not own continue to pass as conformant.
+
+Records already issued under v0.1 remain verifiable against the v0.1 specification and the `agentrust-trace` 0.4.x releases, which stay published. They do not become invalid retroactively; they are v0.1 records and are read as such. Producers should move to v0.2 at their next release.
+
+---
+
+## Abstract
+
+TRACE (Trust, Runtime Attestation, and Compliance Evidence) defines an open, portable, hardware-enforced governance record for AI agents and other confidential workloads. It binds *what executed* (model, code, runtime), *under what policy*, *on what data class*, *invoking which tools*, into a single signed artifact rooted in silicon attestation. The record travels with the workload across hosts, clouds, and providers and is verifiable offline by any party.
+
+TRACE composes existing standards rather than replacing them. It profiles RATS/EAT (RFC 9711) for the wire envelope, SLSA for build-time provenance, SCITT for transparency anchoring, SPIFFE for workload identity, EAR for evidence appraisal, and MCP / A2A for the agent execution surface. Where gaps exist — notably the AI-agent execution profile — TRACE proposes the minimum new schema to close them.
+
+The first reference build is **Confidential MCP (cMCP)**: runtime attestation, policy enforcement, and signed evidence at the Model Context Protocol boundary, on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell confidential GPUs.
+
+---
+
+## 1. Problem
+
+AI builders shipping agents into regulated environments hit the same wall at every deployment: security and compliance review. Internal risk teams, external auditors, and customer CISOs all ask one question:
+
+> *"How do you prove the agent handled our data according to policy?"*
+
+The vocabulary lags the system. Auditors still say *the model* because that is the language that has been in use since before agents existed. What they are actually asking about — and what the AI builder owes them — is the entire agent execution: the model invocation, the tools the agent called, the data classes it touched at each step, and the policies that bound the whole sequence.
+
+The wall is not technical capability — it is evidence. AI builders today produce policy documents, SOC reports, vendor self-attestation, and mutable application logs. None prove what actually happened during execution, so review cycles stretch from days into months.
+
+| Layer | What exists | What is missing |
+|---|---|---|
+| Static documentation | Model Cards, Data Cards, AIBOMs (SPDX 3.0 / CycloneDX 1.7) | No runtime binding — diverges from deployed reality |
+| Operational tracking | MLflow, W&B, vendor logs | Self-reported, mutable, no tamper evidence |
+| Hardware attestation | NVIDIA NRAS, Intel Trust Authority, AMD SEV-SNP, AWS Nitro, Azure MAA, GCP Confidential Space | Proves the environment is genuine — no governance, policy, or data-class binding |
+| Content provenance | C2PA Content Credentials | Proves content origin — silent on inference execution |
+| Compliance frameworks | NIST AI RMF, ISO 42001, EU AI Act Annex IV / Article 12 | Mandate documentation; no prescribed cryptographic format |
+| **Execution governance proof** | **Vendor-proprietary artifacts** | **No open, portable, vendor-neutral standard exists** |
+
+The result: every regulated AI deployment re-litigates trust at every host boundary. Each cloud, each model provider, each agent framework ships its own evidence shape. Auditors cannot compare. Verifiers cannot federate. Workloads cannot move.
+
+The EU AI Act mandates tamper-evident logging for high-risk AI (Article 12); under the current provisional timeline those obligations apply from around December 2027. Frameworks already in force — DORA for financial entities, HIPAA for healthcare — carry equivalent audit-trail requirements today. Autonomous agents inside critical infrastructure are landing before the standard exists to govern them.
+
+---
+
+## 2. Threat Model
+
+TRACE is sound only against named adversaries and named failure modes, under named assumptions.
+
+### 2.1 The three questions an AI builder cannot answer today
+
+1. **What actually ran?** Not what was deployed. Not what the manifest says. *What was loaded into memory and executed at the moment the customer's data was processed* — model weights digest, agent code, dependency tree, runtime image, policy bundle — bound together cryptographically and reproducibly verifiable by an outside party.
+
+2. **What did it actually do?** Which tools the agent called. With what parameters. Against what data class. With what response. In what order. Across how many agent hops. Software-layer telemetry is self-reported and mutable. *Scope: TRACE captures invocations crossing a protocol boundary (MCP, A2A, and other instrumented surfaces). Functions embedded inside the deployed binary fall outside `tool_transcript` and are bound only by `build_provenance` and `model`.*
+
+3. **What rules were actually in force?** Not the policy on the document. *The policy bundle hash bound to the workload at execution time, with the enforcement mode it ran under*, verifiable independently of the workload that ran it.
+
+Each question maps to a Trust Record claim:
+
+- `runtime` + `model` + `build_provenance` answer (1).
+- `tool_transcript` answers (2).
+- `policy` + `data_class` answer (3).
+
+### 2.2 Adversary classes in scope
+
+- **The agent itself, under autonomy.** AI agents are non-deterministic. They may invoke tools, route data, and act in ways no software policy anticipated under prompt injection, goal hijack, alignment drift, tool misuse, or routine non-determinism. TRACE does not prevent misbehavior. It makes misbehavior crossing a protocol boundary visible at the moment of execution.
+- **Cloud or infrastructure operator with root.** A privileged operator on the host — CSP staff, data center personnel, a compromised hypervisor, or a co-tenant that escapes isolation. Cannot be trusted to honor policy or to report execution faithfully.
+- **Compromised orchestration layer.** A kubelet, container runtime, or control plane that may substitute, restart, or steer the workload it schedules.
+- **Malicious or compromised dependency.** A poisoned model artifact, agent package, container base image, or transitive build-chain dependency.
+- **Colluding verifier or issuer.** A relying party that may collude with the issuer to fabricate evidence.
+
+### 2.3 Trusted Computing Base
+
+TRACE Records are sound only when:
+
+- The silicon root of trust (Intel TDX, AMD SEV-SNP, NVIDIA H100/Blackwell CC, and equivalents) is uncompromised, with current firmware and unrevoked vendor keys.
+- The published Reference Integrity Manifests (RIMs) for firmware, kernel, image, and workload are accurate and signed by their respective vendors.
+- The transparency log substrate(s) honor append-only semantics.
+- The verifier evaluates evidence against current revocation, reference data, and policy as of the verification time.
+
+### 2.4 Permanent scope boundaries
+
+TRACE does not protect against:
+
+- TEE side-channel attacks (cache, timing, speculative execution, power analysis).
+- Compromise or coercion of a silicon root vendor or transparency log operator.
+- Model behavior — prompt injection, jailbreaks, hallucination, alignment drift. TRACE proves what executed and which countermeasures were in force; it does not adjudicate whether the model's output was correct.
+- Availability and denial-of-service.
+- UX-layer attacks against the human in the loop.
+
+---
+
+## 3. Trust Record
+
+### 3.1 Logical schema
+
+The Trust Record is the unit of evidence. All fields are required unless marked OPTIONAL.
+
+| Field | Description | Source primitive |
+|---|---|---|
+| `subject` | Workload identity (agent, tool, model invocation) | SPIFFE SVID or DID URI |
+| `model` | Model identity, weights digest, version | EAT claim + AIBOM reference |
+| `runtime` | TEE measurement chain (firmware → kernel → image → workload) | RATS Evidence + vendor RIM |
+| `policy` | Bound policy set hash + enforcement mode. `enforcement_mode` MUST default to `enforce`; a deployment MUST explicitly configure `silent` mode. | Policy artifact hash sealed to TEE measurement |
+| `data_class` | Classification of inputs and outputs | Classification label bound to per-call execution |
+| `tool_transcript` | MCP / A2A tool calls invoked, parameters classified, responses filtered | MCP / A2A protocol transcripts bound to TEE measurement |
+| `build_provenance` | How the running code and model were built | SLSA Provenance v1.0 |
+| `appraisal` | Verifier's appraisal of evidence | EAR (EAT Attestation Results) |
+| `transparency` | Inclusion proof on append-only log | SCITT Receipt URI |
+| `cnf` | Confirmation key — binds record to TEE-held signing key | EAT `cnf` claim (RFC 8747) |
+| `eat_profile` | Profile URI identifying this as a TRACE v0.2 record | EAT profile claim |
+| `iat` | Issued-at timestamp (Unix epoch) | EAT standard claim |
+| `signature` | OPTIONAL as a record field: embedded signature by the `cnf` key over the canonical record (section 3.2.2). Profiles using an enveloping signature (JWS, COSE, cMCP RuntimeClaim) omit this field and carry the signature in the envelope. The signature binding itself is mandatory either way. | JWS / COSE signature over canonical JSON |
+
+Each field is independently verifiable. Sub-records (e.g., per-tool-call transcripts) compose under one root envelope.
+
+### 3.2 Wire format
+
+**Envelope:** EAT (RFC 9711) — JWT (JSON, human-readable contexts) or CWT/CBOR-COSE (constrained and high-throughput contexts).
+
+**Profile URI:** `tag:agentrust-io.com,2026:trace-v0.2`
+
+**JWT example (readable form):**
+
+```json
+{
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
+  "iat": 1750676142,
+  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
+  "model": {
+    "provider": "anthropic",
+    "model_id": "claude-sonnet-4-6",
+    "version": "20251001",
+    "weights_digest": "sha256:a3f8d2c1e9b04756..."
+  },
+  "runtime": {
+    "platform": "amd-sev-snp",
+    "measurement": "sha384:c9e4b1d2e3f4a5b6...",
+    "rim_uri": "https://kdsintf.amd.com/vcek/v1/Milan/..."
+  },
+  "policy": {
+    "bundle_hash": "sha256:b2c3d4e5f6a7b8c9...",
+    "enforcement_mode": "enforce",
+    "version": "1.2.0"
+  },
+  "data_class": "confidential",
+  "tool_transcript": {
+    "hash": "sha256:d4e5f6a7b8c9d0e1...",
+    "call_count": 3,
+    "transcript_uri": "https://registry.agentrust.io/transcript/..."
+  },
+  "build_provenance": {
+    "slsa_level": 2,
+    "builder": "https://github.com/slsa-framework/slsa-github-generator",
+    "digest": "sha256:e5f6a7b8c9d0e1f2..."
+  },
+  "appraisal": {
+    "status": "affirming",
+    "verifier": "https://trust-authority.example.org",
+    "policy_ref": "https://trust-authority.example.org/policy/agent-v1"
+  },
+  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:15:42Z-f2a8d1",
+  "cnf": {
+    "jwk": {
+      "kty": "EC",
+      "crv": "P-256",
+      "x": "MEkwEw...",
+      "y": "GHkVPy..."
+    }
+  }
+}
+```
+
+#### 3.2.1 Signing and key management
+
+- **JWT contexts (RFC 7515):** `ES256`, `ES384`, or `EdDSA` (Ed25519). Composite chains across silicon-root and workload segments are expressed as nested JWTs with `x5c` chains or `kid` resolving into vendor RIM directories.
+- **CBOR-COSE contexts (RFC 9052/9053):** `COSE_Sign1` for single-signer records; `COSE_Sign` for multi-signer records.
+- **Key hierarchy:** silicon root key (vendor-managed, hardware-bound) → platform attestation key (e.g., Intel TDX Quote signing key, AMD VCEK/VLEK, NVIDIA NRAS) → workload attestation key (TEE-bound, ephemeral) → record-signing key (per workload, optionally per session).
+- **Revocation:** silicon-root revocation is consumed from existing vendor channels. Workload-level keys SHOULD rotate at TEE-image boundaries. Verifiers MUST consult current revocation status at verification time.
+- **Hash agility:** SHA-256 minimum; SHA-384 required for FIPS-aligned profiles. Algorithm signaled in the EAT envelope per RFC 9711 §6.
+
+#### 3.2.2 Mandatory signature and freshness binding
+
+**Signature binding.** Every TRACE Trust Record MUST be cryptographically bound by a signature over its canonical JSON form, made by the key in `cnf`. Canonicalization is RFC 8785 (JCS) unless the profile declares a different canonicalization. The signature MAY be either:
+
+- **Embedded:** carried in the record's top-level `signature` field (base64url, no padding), computed over the canonical form of the record with the `signature` field absent; or
+- **Enveloping:** carried by a signed wrapper structure, e.g. a JWS (RFC 7515) whose payload is the record, a COSE_Sign1 envelope, or cMCP's RuntimeClaim (signature over the canonical record, key in `trace.cnf.jwk`).
+
+**Canonical form (RFC 8785 JCS).** The canonical form of a TRACE record for signature purposes is produced by the following algorithm:
+
+1. Construct the record object with all fields EXCEPT the `signature` field (for embedded-signature profiles) or the outer envelope (for enveloping-signature profiles). The `cnf` field, including `cnf.jwk`, is included in the canonical form.
+2. Apply RFC 8785 JSON Canonicalization Scheme (JCS) to produce a deterministic byte sequence:
+   - Object keys are sorted in Unicode code-point order (ascending).
+   - No whitespace between tokens.
+   - Numbers are serialized in IEEE 754 double-precision format using the shortest decimal representation that round-trips.
+   - Strings are serialized as UTF-8; only the characters mandated by RFC 8259 §7 are escaped (U+0022, U+005C, and U+0000–U+001F).
+3. Encode the result as UTF-8 bytes. This byte sequence is the pre-image for the signature.
+
+Implementations MUST use an RFC 8785-conformant library. Using `json.dumps(sort_keys=True)` (Python) or equivalent ad-hoc sorting is insufficient: it diverges from RFC 8785 for non-ASCII strings and for IEEE 754 number serialization.
+
+Each profile MUST declare which binding form it uses. A record with no verifiable signature binding is not a Trust Record: verifiers MUST reject it. Schema validity alone confers no trust.
+
+**Freshness.** Records MUST carry `iat`. Verifiers MUST enforce a maximum record age: a record whose `iat` is older than the maximum age MUST be rejected. The default maximum age is 24 hours; a deployment profile MAY specify a different value. Verifiers SHOULD additionally support challenge-nonce binding for online verification: the verifier supplies a nonce, the issuer echoes it in `runtime.nonce`, and the verifier checks the echo. When a challenge nonce was issued, a record that omits or mismatches it MUST be rejected.
+
+**Conformance alignment.** The TRACE conformance suite (trace-tests) already enforces both rules: records without a verifiable signature fail at conformance level 1 and above, and the default 24-hour max-age is enforced.
+
+### 3.3 Verification
+
+Any party — browser, CLI, in-cluster verifier, third-party auditor — verifies:
+
+1. The record's signature binding (section 3.2.2) verifies against the key in `cnf`, BEFORE any other field is trusted. A record with no verifiable binding MUST be rejected.
+2. The record is fresh: `iat` is within the maximum age (default 24 hours unless the deployment profile specifies otherwise). If the verifier issued a challenge nonce, `runtime.nonce` echoes it.
+3. Signature chain resolves to a known silicon root (NVIDIA, Intel, AMD, or equivalent).
+4. Runtime measurements match published Reference Integrity Manifests (RIMs).
+5. Policy hash matches the policy bundle the verifier expects.
+6. SCITT receipt resolves on the named transparency log.
+7. SLSA provenance resolves to a trusted builder.
+
+No callback to the issuer. No vendor in the trust path beyond silicon root and transparency log operators.
+
+#### 3.3.1 External execution evidence (optional)
+
+Some deployments attach independent, out-of-band receipts to individual audit-chain entries — for example, a signed assertion from a safety controller confirming or rejecting an actuation request. The TRACE Trust Record commits the audit chain by hash; the receipts live inside that chain, not inside the Trust Record itself. This section defines how a verifier treats them.
+
+A receipt within an audit-chain entry is characterized by: an issuer identity (`issuer`), a key reference (`issuer_key_id`), a signature over the canonical receipt fields (`signature`), a content digest (`evidence_hash`), a type tag (`evidence_type`), and a binding to the corresponding tool call (`linked_call_id`).
+
+**Verification rule.** When a verifier is configured with a trusted public key for the named `issuer_key_id`:
+
+1. Compute the canonical form (RFC 8785 JCS) of the receipt fields excluding `signature`.
+2. Verify the `signature` against that canonical form using the configured issuer key.
+3. Assert that `linked_call_id` equals the `call_id` of the enclosing audit-chain entry.
+
+A verifier configured with the issuer key that fails any of these three checks MUST treat the audit entry as invalid and reject the Trust Record.
+
+**When the issuer key is not configured.** A receipt whose issuer key is unknown to the verifier is unverified, not invalid. The Trust Record's gateway-produced evidence (signature, audit-chain hash, policy hash, TEE measurement) is unaffected. Verifiers SHOULD surface an advisory status (e.g., `external_evidence_unverified`) rather than silently ignoring the receipt.
+
+**Trust boundary.** External execution evidence is only as trustworthy as the issuer key and the PKI behind it. TRACE binds the receipt into the audit chain — it does not certify that a physical action occurred, that it was executed safely, or that any functional-safety standard was met. Those claims belong to the issuer and its certification body, not to TRACE.
+
+#### 3.3.2 Action receipts for embodied workflows (informative)
+
+Embodied-agent profiles need to keep three evidence layers separate:
+
+| Layer | TRACE role | Boundary |
+|---|---|---|
+| Session evidence | The Trust Record, policy hash, runtime measurement, and `tool_transcript.hash` bind the governed session. | Does not expose every call unless the verifier has the transcript bytes. |
+| Action issuance evidence | Per-call receipts can prove that a specific action request was issued, signed, ordered, and bound to the session or call. | Does not prove that the requested physical or business outcome completed. |
+| Outcome evidence | Controller, monitor, human-review, or safety-system observations can describe acceptance, rejection, aborts, or completion. | The claim belongs to the external issuer, not to core TRACE validity. |
+
+This split is intentionally independent of build-provenance depth. A verifier
+can have a fully verified dependency chain with no action receipts, or a
+complete action-receipt chain for a workload whose builder is only surface
+checked. Future profiles may express this as a separate action-receipt
+requirement, such as `required`, `optional`, or `none`, without folding action
+evidence into the supply-chain provenance axis.
+
+An action receipt profile can build on the external execution evidence rules in
+section 3.3.1 by requiring the verifier to:
+
+1. recompute the receipt's action or evidence digest from the canonical action
+   preimage;
+2. verify the receipt signature against a pinned, manifest-bound, or otherwise
+   trusted issuer key, not only against a key embedded in the receipt;
+3. verify receipt ordering when receipts are hash-chained;
+4. verify that the receipt binds back to the TRACE session, transcript entry, or
+   cMCP call identifier; and
+5. report missing, stale, mismatched, or unverifiable receipts separately from a
+   verified controller rejection.
+
+A signed controller rejection is valid negative evidence: it can prove that the
+controller rejected the action request under a trusted key and session binding.
+It is not a TRACE verification failure unless the receipt itself is malformed,
+untrusted, stale, out of order, or not bound to the expected call. Conversely, a
+signed acceptance receipt is not proof of physical completion or
+functional-safety certification unless the external issuer and profile
+explicitly make, and the verifier is configured to trust, that stronger claim.
+
+### 3.4 Scope
+
+TRACE governs any confidential workload — AI agent execution, regulated data processing, sovereign compute, secure multi-party computation. AI agents are the forcing function and the first reference profile, not the limit of the standard.
+
+---
+
+## 4. Standards Composition
+
+TRACE is a **profile**, not a parallel stack. It binds existing primitives into one coherent artifact.
+
+```
+                   ┌─────────────────────────────────────┐
+                   │       TRACE Trust Record            │
+                   │   (EAT envelope, JWT or CBOR-COSE)  │
+                   └─────────────────────────────────────┘
+                                     │
+     ┌───────────────────────────────┼──────────────────────────────┐
+     │                               │                              │
+┌────▼─────┐    ┌──────────┐    ┌────▼────┐    ┌──────────┐    ┌────▼────┐
+│  SLSA    │    │ SPIFFE   │    │  RATS   │    │   EAR    │    │  SCITT  │
+│provenance│    │  SVID    │    │ Evidence│    │ Appraisal│    │ Receipt │
+│ (build)  │    │(identity)│    │ (TEE)   │    │(verifier)│    │ (anchor)│
+└──────────┘    └──────────┘    └─────────┘    └──────────┘    └─────────┘
+                                      │
+                               ┌──────▼──────┐    ┌──────────┐
+                               │  EAT        │    │  AIBOM   │
+                               │  RFC 9711   │    │ SPDX 3.0 │
+                               │ (envelope)  │    │CycloneDX │
+                               └─────────────┘    └──────────┘
+```
+
+### 4.1 Primitives composed
+
+- **RATS / EAT (RFC 9711)** — wire envelope and claim model. NVIDIA NRAS, Intel Trust Authority, and Azure MAA produce attestation tokens that map into this envelope through vendor-co-authored annexes (see §4.4).
+- **SLSA Provenance v1.0** — build-time provenance. Build Level 2 minimum for TRACE-conformant records in v1.0; Build Level 3 is the target for production reference implementations.
+- **SPIFFE / SPIRE** — workload identity. The SVID is bound to the TEE measurement so identity is rooted in hardware.
+- **SCITT** — append-only transparency log. TRACE defines a SCITT profile for Trust Record inclusion (Signed Statement registration, Receipt format, key rotation semantics).
+- **EAR (draft-ietf-rats-ar4si)** — verifier output format. Separates *what was claimed* from *what was accepted*.
+- **MCP** — Model Context Protocol tool surface. TRACE adds (a) cryptographic binding of the transcript hash into the EAT envelope and (b) a per-call `data_class` classification. MCP profile targeted for v0.2.
+- **A2A** — Agent-to-Agent communication. TRACE adds transcript binding and cross-protocol identity threading via SPIFFE SVID. A2A profile targeted for v0.2.
+- **AIBOM (SPDX 3.0 AI Profile, CycloneDX 1.7 ML-BOM)** — component inventory for models, datasets, dependencies. Referenced by digest from `model`.
+- **C2PA** — adjacent, not absorbed. Where a TRACE'd execution produces media, the output may carry a C2PA manifest that references the Trust Record.
+
+### 4.2 Hardware roots
+
+- **NVIDIA** — H100, H200, Blackwell with confidential computing mode. NRAS EAT.
+- **Intel** — TDX with Trust Authority. TDX Quote (DCAP) + MRTD + RTMRs.
+- **AMD** — SEV-SNP with VCEK/VLEK chain to AMD Root Key. CoRIM CBOR mapping.
+- **Cloud platform attestation** — Azure MAA, GCP Confidential Space, AWS Nitro Enclaves all expressible as RATS Evidence and composable into a TRACE envelope.
+
+### 4.3 Bindings TRACE adds
+
+These components exist in their respective ecosystems. TRACE adds the binding rule that places each into a hardware-attested envelope:
+
+- **`policy` claim.** Policy artifacts (OPA bundles, Cedar policies, custom DSLs) and policy hashing are established. TRACE adds the binding: the policy bundle hash is sealed to the TEE measurement, the enforcement mode is recorded, and substituting the policy invalidates the runtime claim. Gateways MUST default `enforcement_mode` to `enforce`. A deployment MUST explicitly configure `silent` mode; `silent` MUST NOT be the default. In `silent` mode, the audit chain still records every would-have-denied decision; only operational log lines are suppressed.
+- **`data_class` claim.** Data classification schemes are established (DLP labels, NIST SP 800-60, sensitivity tags). TRACE adds: a classification label is attached to inputs and outputs at the per-call layer and recorded in the Trust Record alongside the runtime evidence.
+- **`tool_transcript` claim.** MCP and A2A transcripts exist at the protocol layer. TRACE adds cryptographic binding of the transcript hash into the EAT envelope and per-call parameter classification.
+- **AI-agent execution profile.** A profile registry that pins the claim set, evidence requirements, and verification rules for AI-agent workloads specifically.
+
+### 4.4 Vendor profile annexes
+
+TRACE will publish vendor-co-authored claim-mapping annexes — one per silicon-root and cloud-attestation surface — as informative companions to v1.0. Co-editor slots open for:
+
+| Surface | Co-editor slot |
+|---|---|
+| NVIDIA Remote Attestation Service | NVIDIA |
+| Microsoft Azure Attestation | Microsoft |
+| Google Cloud Attestation / Confidential Space | Google |
+| Intel Trust Authority | Intel |
+| AMD CoRIM (SEV-SNP) | AMD |
+
+---
+
+## 5. Reference Implementation: Confidential MCP (cMCP)
+
+the reference implementation at the MCP tool-call boundary.
+
+| Phase | What ships | TRACE fields | Timeline |
+|---|---|---|---|
+| **Phase 1 — Runtime Trust** | MCP server runs in TEE; SPIFFE identity bound to TEE measurement; signed Trust Record per invocation | `subject`, `runtime`, `build_provenance`, `cnf`, `transparency` | Q2 2026 |
+| **Phase 2 — Policy Enforcement** | Transparent JSON-RPC proxy inside TEE; per-tool policy + parameter classification | + `policy`, `data_class`, `tool_transcript` | Q3 2026 |
+| **Phase 3 — Workflow Provenance** | Native SDK; cross-MCP lineage; provenance DAG | Full Trust Record | Q4 2026+ |
+
+**Hardware:** Intel TDX, AMD SEV-SNP, NVIDIA H100/Blackwell CC.
+
+**Deployment:** Confidential VMs and Confidential Containers (Kata-CC) on AKS, GCP Confidential Space, AWS Nitro Enclaves, and on-prem. BYOW — existing MCP servers run unchanged.
+
+---
+
+## 6. Governance
+
+### 6.1 Proposed host
+
+**CoSAI** (Coalition for Secure AI) for the technical workstream; the **Linux Foundation entity hosting the Model Context Protocol** for spec, IP, trademark, and conformance mark. Co-locating TRACE governance with the protocol whose attestation surface TRACE most directly profiles inherits LF's IP and trademark machinery.
+
+Other standards bodies participate as technical-liaison partners: OpenSSF (SLSA stewardship), CNCF (SPIFFE/SPIRE stewardship), IETF (RATS, EAT, SCITT, EAR working groups).
+
+### 6.2 Target contributing organizations
+
+The following organizations have been identified as natural contributors to this standard based on their work in confidential computing, AI safety, and open governance. Formal participation is subject to each organization's independent decision.
+
+Anthropic, NVIDIA, Intel, AMD, Microsoft, Google, Linux Foundation, Confidential Computing Consortium, ATRC, TII, AI71.
+
+### 6.3 IP and licensing
+
+- **Specifications:** CC BY 4.0.
+- **Reference code:** Apache 2.0.
+- **Test suite:** Apache 2.0, mandatory for conformance claims.
+- **Conformance mark:** managed by host org.
+
+---
+
+## 7. Open Questions
+
+These need input before v0.2:
+
+1. **Host organization.** CoSAI, Linux Foundation, or a federated arrangement?
+2. **AI-agent profile vs general profile.** One inclusive profile or split agent execution and generic confidential workload from day one?
+3. **Transparency log operator(s).** One canonical SCITT log, federated logs, or BYO with conformance criteria?
+4. **Policy language.** TRACE binds a policy *hash*. Does v1.0 also specify a policy *language* (Cedar, Rego, custom DSL), or stay language-agnostic?
+5. **Privacy of the record.** Records may contain sensitive classifications. Standardize encrypted-claims envelope (JWE / COSE-Encrypt) from v1.0?
+6. **A2A profile timing.** Ship A2A as a peer profile to MCP in v1.0, or wait for A2A to stabilize?
+7. **Relationship to IETF AIIP.** Absorb, supersede, or coexist with draft-ritz-aiip?
+
+---
+
+## Appendix A — Glossary
+
+| Term | Definition |
+|---|---|
+| TCB | Trusted Computing Base. Components whose correctness a TRACE Record's validity depends on |
+| TEE | Trusted Execution Environment — Intel TDX, AMD SEV-SNP, NVIDIA H100/Blackwell CC |
+| EAT | Entity Attestation Token (RFC 9711). RATS wire envelope. JWT or CBOR-COSE |
+| RATS | Remote Attestation Procedures (IETF). The attestation architecture |
+| EAR | EAT Attestation Results — verifier appraisal output format |
+| SLSA | Supply-chain Levels for Software Artifacts (OpenSSF). Build-time provenance |
+| SCITT | Supply Chain Integrity, Transparency, Trust (IETF). Append-only transparency log primitive |
+| SPIFFE | Secure Production Identity Framework For Everyone (CNCF). Workload identity |
+| AIBOM | AI Bill of Materials (SPDX 3.0 AI Profile, CycloneDX 1.7 ML-BOM) |
+| MCP | Model Context Protocol. Agent tool-call surface |
+| A2A | Agent-to-Agent (Google). Inter-agent communication protocol |
+| C2PA | Coalition for Content Provenance and Authenticity. Content origin manifests |
+| RIM | Reference Integrity Manifest. Vendor-published reference measurements |
+| Trust Record | TRACE's portable signed artifact — see §3 |
+| cMCP | Confidential MCP — TRACE reference implementation at the MCP boundary |
+
+---
+
+## Appendix B — References
+
+### IETF
+
+- RATS Architecture (RFC 9334) — https://www.rfc-editor.org/rfc/rfc9334
+- EAT — Entity Attestation Token (RFC 9711) — https://www.rfc-editor.org/rfc/rfc9711
+- SCITT Architecture (draft-ietf-scitt-architecture) — https://datatracker.ietf.org/doc/draft-ietf-scitt-architecture/
+- SCITT Reference APIs (draft-ietf-scitt-scrapi) — https://datatracker.ietf.org/doc/draft-ietf-scitt-scrapi/
+- EAR / AR4SI (draft-ietf-rats-ar4si) — https://datatracker.ietf.org/doc/draft-ietf-rats-ar4si/
+- JWS (RFC 7515) — https://www.rfc-editor.org/rfc/rfc7515
+- JWE (RFC 7516) — https://www.rfc-editor.org/rfc/rfc7516
+- COSE (RFC 9052/9053) — https://www.rfc-editor.org/rfc/rfc9052
+- JWK / cnf claim (RFC 7517 / RFC 7800) — https://www.rfc-editor.org/rfc/rfc7517
+- JWK Thumbprint (RFC 7638) — https://www.rfc-editor.org/rfc/rfc7638
+- JSON Canonicalization Scheme / JCS (RFC 8785) — https://www.rfc-editor.org/rfc/rfc8785
+
+### Foundation Specifications
+
+- SLSA Specification v1.0 (OpenSSF) — https://slsa.dev/spec/v1.0/
+- SPIFFE / SPIRE Specifications (CNCF) — https://spiffe.io/docs/latest/spiffe-about/
+- SPDX 3.0 AI Profile — https://spdx.dev/use/specifications/
+- CycloneDX 1.7 ML-BOM — https://cyclonedx.org/specification/overview/
+- C2PA Technical Specification v2 — https://c2pa.org/specifications/specifications/2.0/
+- Sigstore / Rekor — https://docs.sigstore.dev/
+
+### Vendor Hardware Attestation
+
+- NVIDIA Remote Attestation Service — https://docs.nvidia.com/attestation/api-docs-nras/
+- Intel Trust Authority — https://www.intel.com/content/www/us/en/security/trust-authority.html
+- Intel TDX — https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/overview.html
+- AMD SEV-SNP — https://www.amd.com/en/developer/sev.html
+- Microsoft Azure Attestation — https://learn.microsoft.com/en-us/azure/attestation/overview
+- Microsoft Azure Confidential Ledger — https://learn.microsoft.com/en-us/azure/confidential-ledger/
+- GCP Confidential Space — https://cloud.google.com/confidential-computing/confidential-space/docs
+- AWS Nitro Enclaves — https://aws.amazon.com/ec2/nitro/nitro-enclaves/
+
+### Adjacent Work
+
+- Project Oak (Google DeepMind) — https://github.com/project-oak/oak
+- Anthropic MCP Specification — https://modelcontextprotocol.io/specification/
+- Google A2A Specification — https://a2a-protocol.org/latest/specification/
+- MITRE ATLAS — https://atlas.mitre.org/
+- OWASP Top 10 for Agentic Applications — https://genai.owasp.org/
diff --git a/src/agentrust_trace/__pycache__/__init__.cpython-312.pyc b/src/agentrust_trace/__pycache__/__init__.cpython-312.pyc
index 3a9405a..b616624 100644
Binary files a/src/agentrust_trace/__pycache__/__init__.cpython-312.pyc and b/src/agentrust_trace/__pycache__/__init__.cpython-312.pyc differ
diff --git a/src/agentrust_trace/__pycache__/models.cpython-312.pyc b/src/agentrust_trace/__pycache__/models.cpython-312.pyc
index 4507c12..b6ce437 100644
Binary files a/src/agentrust_trace/__pycache__/models.cpython-312.pyc and b/src/agentrust_trace/__pycache__/models.cpython-312.pyc differ
diff --git a/src/agentrust_trace/__pycache__/sign.cpython-312.pyc b/src/agentrust_trace/__pycache__/sign.cpython-312.pyc
index 49a8c32..eaf171d 100644
Binary files a/src/agentrust_trace/__pycache__/sign.cpython-312.pyc and b/src/agentrust_trace/__pycache__/sign.cpython-312.pyc differ
diff --git a/src/agentrust_trace/__pycache__/validate.cpython-312.pyc b/src/agentrust_trace/__pycache__/validate.cpython-312.pyc
index cec46a0..f352abe 100644
Binary files a/src/agentrust_trace/__pycache__/validate.cpython-312.pyc and b/src/agentrust_trace/__pycache__/validate.cpython-312.pyc differ
diff --git a/src/agentrust_trace/adapters/__pycache__/__init__.cpython-312.pyc b/src/agentrust_trace/adapters/__pycache__/__init__.cpython-312.pyc
index 36065a4..0608f28 100644
Binary files a/src/agentrust_trace/adapters/__pycache__/__init__.cpython-312.pyc and b/src/agentrust_trace/adapters/__pycache__/__init__.cpython-312.pyc differ
diff --git a/src/agentrust_trace/adapters/__pycache__/agt.cpython-312.pyc b/src/agentrust_trace/adapters/__pycache__/agt.cpython-312.pyc
index c8d121a..2f49ca4 100644
Binary files a/src/agentrust_trace/adapters/__pycache__/agt.cpython-312.pyc and b/src/agentrust_trace/adapters/__pycache__/agt.cpython-312.pyc differ
diff --git a/src/agentrust_trace/adapters/agt.py b/src/agentrust_trace/adapters/agt.py
index 2f9407a..084cff1 100644
--- a/src/agentrust_trace/adapters/agt.py
+++ b/src/agentrust_trace/adapters/agt.py
@@ -70,7 +70,7 @@ class TraceAGTAdapter:
             model_id="claude-sonnet-4-6",
             model_version="20251001",
             build_provenance_digest="sha256:e5f6a7b8...",
-            transparency="https://registry.agentrust.io/claim/...",
+            transparency="https://registry.agentrust-io.com/claim/...",
         )
 
         record = adapter.build_trust_record(session)
@@ -95,7 +95,7 @@ def __init__(
         build_provenance_builder: str | None = None,
         build_provenance_uri: str | None = None,
         transparency: str,
-        appraisal_verifier: str = "https://agentrust.io/verify",
+        appraisal_verifier: str = "https://agentrust-io.com/verify",
         appraisal_policy_ref: str | None = None,
         enforcement_mode: str = "enforce",
     ) -> None:
@@ -141,7 +141,7 @@ def build_trust_record(self, session: AGTSessionResult) -> dict[str, Any]:
         )
 
         record: dict[str, Any] = {
-            "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+            "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
             "iat": session.iat,
             "subject": session.agent_did,
             "model": self._model.model_dump(exclude_none=True),
diff --git a/src/agentrust_trace/models.py b/src/agentrust_trace/models.py
index a324c7f..d0270b1 100644
--- a/src/agentrust_trace/models.py
+++ b/src/agentrust_trace/models.py
@@ -146,7 +146,7 @@ class TrustRecord(BaseModel):
 
     model_config = ConfigDict(extra="forbid")
 
-    eat_profile: Literal["tag:agentrust.io,2026:trace-v0.1"]
+    eat_profile: Literal["tag:agentrust-io.com,2026:trace-v0.2"]
     iat: Annotated[int, Field(ge=1700000000)]
     subject: Annotated[str, Field(pattern=r"^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$")]
     model: ModelInfo
diff --git a/src/agentrust_trace/schema/trace-v0.2.json b/src/agentrust_trace/schema/trace-v0.2.json
new file mode 100644
index 0000000..e1fe4a5
--- /dev/null
+++ b/src/agentrust_trace/schema/trace-v0.2.json
@@ -0,0 +1,285 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentrust-io.com/schema/trace-v0.2.json",
+  "title": "TRACE Trust Record",
+  "description": "A TRACE v0.2 Trust Record — hardware-attested governance evidence for an AI agent execution.",
+  "type": "object",
+  "required": [
+    "eat_profile",
+    "iat",
+    "subject",
+    "model",
+    "runtime",
+    "policy",
+    "data_class",
+    "build_provenance",
+    "appraisal",
+    "transparency",
+    "cnf"
+  ],
+  "properties": {
+    "eat_profile": {
+      "type": "string",
+      "const": "tag:agentrust-io.com,2026:trace-v0.2",
+      "description": "EAT profile URI identifying this as a TRACE v0.2 Trust Record."
+    },
+    "iat": {
+      "type": "integer",
+      "description": "Issued-at time as Unix epoch seconds.",
+      "minimum": 1700000000
+    },
+    "subject": {
+      "type": "string",
+      "description": "Workload identity as a SPIFFE SVID URI.",
+      "pattern": "^spiffe://"
+    },
+    "model": {
+      "type": "object",
+      "description": "Model identity and provenance.",
+      "required": ["provider", "model_id"],
+      "properties": {
+        "provider": {
+          "type": "string",
+          "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')."
+        },
+        "model_id": {
+          "type": "string",
+          "description": "Model identifier as used by the provider."
+        },
+        "version": {
+          "type": "string",
+          "description": "Model version or snapshot identifier."
+        },
+        "weights_digest": {
+          "type": "string",
+          "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.",
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
+        },
+        "aibom_uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI to SPDX 3.0 AI Profile or CycloneDX 1.7 ML-BOM for this model."
+        }
+      },
+      "additionalProperties": false
+    },
+    "runtime": {
+      "type": "object",
+      "description": "TEE measurement chain binding the workload to hardware.",
+      "required": ["platform", "measurement"],
+      "properties": {
+        "platform": {
+          "type": "string",
+          "enum": [
+            "intel-tdx",
+            "amd-sev-snp",
+            "azure-cvm-sev-snp",
+            "nvidia-h100",
+            "nvidia-blackwell",
+            "aws-nitro",
+            "arm-cca",
+            "google-confidential-space",
+            "tpm2",
+            "software-only"
+          ],
+          "description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence."
+        },
+        "measurement": {
+          "type": "string",
+          "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).",
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
+        },
+        "rim_uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI to the vendor-published Reference Integrity Manifest for this measurement."
+        },
+        "nonce": {
+          "type": "string",
+          "description": "Freshness nonce binding the attestation report to this record (base64url, no padding)."
+        },
+        "firmware_version": {
+          "type": "string",
+          "description": "Firmware or microcode version included in the measurement."
+        }
+      },
+      "additionalProperties": false
+    },
+    "policy": {
+      "type": "object",
+      "description": "Policy bundle sealed to the TEE measurement.",
+      "required": ["bundle_hash", "enforcement_mode"],
+      "properties": {
+        "bundle_hash": {
+          "type": "string",
+          "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.",
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
+        },
+        "enforcement_mode": {
+          "type": "string",
+          "enum": ["enforce", "advisory", "silent"],
+          "default": "enforce",
+          "description": "How policy decisions were applied: enforce (block on deny), advisory (log and allow), silent (allow and suppress operational logs; the audit chain still records every would-have-denied decision). Gateways MUST default to enforce. A deployment MUST explicitly configure silent mode; it MUST NOT be the default."
+        },
+        "version": {
+          "type": "string",
+          "description": "Policy bundle version (semantic versioning recommended)."
+        },
+        "policy_uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI to the policy bundle for verification."
+        }
+      },
+      "additionalProperties": false
+    },
+    "data_class": {
+      "type": "string",
+      "description": "Highest-sensitivity data classification of inputs and outputs processed during this execution.",
+      "examples": ["public", "internal", "confidential", "restricted", "top-secret"]
+    },
+    "tool_transcript": {
+      "type": "object",
+      "description": "Bound hash of the MCP/A2A tool-call transcript. OPTIONAL for Phase 1 records; REQUIRED for Phase 2+.",
+      "required": ["hash"],
+      "properties": {
+        "hash": {
+          "type": "string",
+          "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.",
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
+        },
+        "call_count": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Total number of tool calls in this session."
+        },
+        "transcript_uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI to the full transcript on the transparency log."
+        }
+      },
+      "additionalProperties": false
+    },
+    "delegation": {
+      "type": "object",
+      "description": "A2A profile: links this record to the delegating hop's Trust Record. Present when this execution acted on delegated authority; absent on a root (non-delegated) execution. A chain of these forms an offline-verifiable delegation DAG.",
+      "required": ["parent_record_hash", "credential_id"],
+      "properties": {
+        "parent_record_hash": {
+          "type": "string",
+          "description": "SHA-256 or SHA-384 digest of the parent hop's Trust Record.",
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
+        },
+        "credential_id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Identifier of the delegation credential this hop acted under."
+        }
+      },
+      "additionalProperties": false
+    },
+    "build_provenance": {
+      "type": "object",
+      "description": "SLSA provenance for the workload (agent code + container image).",
+      "required": ["slsa_level", "digest"],
+      "properties": {
+        "slsa_level": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 3,
+          "description": "SLSA Build Level achieved. Level 2 minimum for TRACE conformance; Level 3 for production mark."
+        },
+        "builder": {
+          "type": "string",
+          "description": "SLSA builder URI."
+        },
+        "digest": {
+          "type": "string",
+          "description": "SHA-256 or SHA-384 digest of the container image or workload binary.",
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
+        },
+        "provenance_uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI to the SLSA provenance attestation on a Sigstore/Rekor or compatible log."
+        }
+      },
+      "additionalProperties": false
+    },
+    "appraisal": {
+      "type": "object",
+      "description": "Verifier's EAR appraisal of the evidence (draft-ietf-rats-ar4si).",
+      "required": ["status", "verifier"],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": ["affirming", "warning", "contraindicated", "none"],
+          "description": "EAR appraisal status."
+        },
+        "verifier": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI identifying the verifier that produced this appraisal."
+        },
+        "policy_ref": {
+          "type": "string",
+          "format": "uri",
+          "description": "URI to the appraisal policy used."
+        },
+        "timestamp": {
+          "type": "integer",
+          "description": "Unix epoch seconds when the appraisal was produced."
+        }
+      },
+      "additionalProperties": false
+    },
+    "transparency": {
+      "type": "string",
+      "format": "uri",
+      "description": "SCITT receipt URI. The Trust Record is the Signed Statement; this URI resolves to the inclusion proof (Receipt) on the transparency log."
+    },
+    "cnf": {
+      "type": "object",
+      "description": "Confirmation key (RFC 8747) — binds the Trust Record to the TEE-held signing key.",
+      "required": ["jwk"],
+      "properties": {
+        "jwk": {
+          "type": "object",
+          "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y.",
+          "required": ["kty"],
+          "properties": {
+            "kty": {"type": "string"},
+            "crv": {"type": "string"},
+            "x":   {"type": "string"},
+            "y":   {"type": "string"},
+            "kid": {"type": "string"}
+          },
+          "allOf": [
+            {
+              "if": {
+                "required": ["kty"],
+                "properties": {"kty": {"const": "OKP"}}
+              },
+              "then": {"required": ["crv", "x"]}
+            },
+            {
+              "if": {
+                "required": ["kty"],
+                "properties": {"kty": {"const": "EC"}}
+              },
+              "then": {"required": ["crv", "x", "y"]}
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "signature": {
+      "type": "string",
+      "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with only this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.",
+      "pattern": "^[A-Za-z0-9_-]+$"
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/src/agentrust_trace/sign.py b/src/agentrust_trace/sign.py
index f45616d..60a6514 100644
--- a/src/agentrust_trace/sign.py
+++ b/src/agentrust_trace/sign.py
@@ -61,7 +61,7 @@ def key_to_jwk(key: Ed25519PrivateKey) -> dict[str, str]:
 def _canonical_bytes(d: dict[str, Any]) -> bytes:
     """Return the RFC 8785 (JCS) canonical UTF-8 byte sequence for *d*.
 
-    This is the signature pre-image mandated by spec/trace-v0.1.md §3.2.2. JCS
+    This is the signature pre-image mandated by spec/trace-v0.2.md §3.2.2. JCS
     sorts object keys by UTF-16 code unit, serializes numbers per the
     ECMAScript Number-to-String / RFC 8785 §3.2.2.3 shortest round-trip form,
     escapes only the characters required by RFC 8259 §7, and emits non-ASCII
diff --git a/src/agentrust_trace/validate.py b/src/agentrust_trace/validate.py
index e5bc5cd..ad1405e 100644
--- a/src/agentrust_trace/validate.py
+++ b/src/agentrust_trace/validate.py
@@ -10,7 +10,7 @@
 
 @lru_cache(maxsize=1)
 def _schema() -> dict[str, Any]:
-    ref = importlib.resources.files("agentrust_trace") / "schema" / "trace-v0.1.json"
+    ref = importlib.resources.files("agentrust_trace") / "schema" / "trace-v0.2.json"
     return cast(dict[str, Any], json.loads(ref.read_text(encoding="utf-8")))
 
 
diff --git a/tests/__pycache__/__init__.cpython-312.pyc b/tests/__pycache__/__init__.cpython-312.pyc
index fc246a3..8042f41 100644
Binary files a/tests/__pycache__/__init__.cpython-312.pyc and b/tests/__pycache__/__init__.cpython-312.pyc differ
diff --git a/tests/__pycache__/test_action_receipt_fixtures.cpython-312-pytest-9.0.3.pyc b/tests/__pycache__/test_action_receipt_fixtures.cpython-312-pytest-9.0.3.pyc
new file mode 100644
index 0000000..fea5c0e
Binary files /dev/null and b/tests/__pycache__/test_action_receipt_fixtures.cpython-312-pytest-9.0.3.pyc differ
diff --git a/tests/__pycache__/test_agt_adapter.cpython-312-pytest-9.0.3.pyc b/tests/__pycache__/test_agt_adapter.cpython-312-pytest-9.0.3.pyc
new file mode 100644
index 0000000..50afbc1
Binary files /dev/null and b/tests/__pycache__/test_agt_adapter.cpython-312-pytest-9.0.3.pyc differ
diff --git a/tests/__pycache__/test_models.cpython-312-pytest-9.0.3.pyc b/tests/__pycache__/test_models.cpython-312-pytest-9.0.3.pyc
new file mode 100644
index 0000000..33f754b
Binary files /dev/null and b/tests/__pycache__/test_models.cpython-312-pytest-9.0.3.pyc differ
diff --git a/tests/__pycache__/test_sign.cpython-312-pytest-9.0.3.pyc b/tests/__pycache__/test_sign.cpython-312-pytest-9.0.3.pyc
new file mode 100644
index 0000000..e92bc62
Binary files /dev/null and b/tests/__pycache__/test_sign.cpython-312-pytest-9.0.3.pyc differ
diff --git a/tests/__pycache__/test_validate.cpython-312-pytest-9.0.3.pyc b/tests/__pycache__/test_validate.cpython-312-pytest-9.0.3.pyc
new file mode 100644
index 0000000..bcd7267
Binary files /dev/null and b/tests/__pycache__/test_validate.cpython-312-pytest-9.0.3.pyc differ
diff --git a/tests/test_agt_adapter.py b/tests/test_agt_adapter.py
index f338eab..2bd3e3d 100644
--- a/tests/test_agt_adapter.py
+++ b/tests/test_agt_adapter.py
@@ -22,7 +22,7 @@
     {"entry_id": 2, "tool": "support.create_ticket", "decision": "permit"},
 ]
 AGENT_DID = "spiffe://trust.example.org/agent/test-agent/prod"
-TRANSPARENCY = "https://registry.agentrust.io/claim/test-abc123"
+TRANSPARENCY = "https://registry.agentrust-io.com/claim/test-abc123"
 
 
 def _make_adapter(**overrides) -> TraceAGTAdapter:
@@ -60,7 +60,7 @@ def test_build_produces_valid_trust_record() -> None:
     record = adapter.build_trust_record(session)
     # Must parse without ValidationError
     tr = TrustRecord.model_validate(record)
-    assert tr.eat_profile == "tag:agentrust.io,2026:trace-v0.1"
+    assert tr.eat_profile == "tag:agentrust-io.com,2026:trace-v0.2"
 
 
 # ---------------------------------------------------------------------------
diff --git a/tests/test_models.py b/tests/test_models.py
index 29c6d97..9970975 100644
--- a/tests/test_models.py
+++ b/tests/test_models.py
@@ -19,7 +19,7 @@ def _load(name: str) -> dict:
 @pytest.mark.parametrize("filename", ["intel-tdx.json", "amd-sev-snp.json", "nvidia-h100.json"])
 def test_example_parses(filename: str) -> None:
     record = TrustRecord.model_validate(_load(filename))
-    assert record.eat_profile == "tag:agentrust.io,2026:trace-v0.1"
+    assert record.eat_profile == "tag:agentrust-io.com,2026:trace-v0.2"
     assert record.subject.startswith(("spiffe://", "did:"))
 
 
@@ -163,44 +163,44 @@ def test_jwk_with_private_key_material_rejected() -> None:
     }
     with pytest.raises(ValidationError):
         TrustRecord.model_validate(data)
-
-
-def test_delegation_block_parses() -> None:
-    data = _load("intel-tdx.json")
-    data["delegation"] = {
-        "parent_record_hash": "sha256:" + "a" * 64,
-        "credential_id": "cred-abc",
-    }
-    record = TrustRecord.model_validate(data)
-    assert record.delegation is not None
-    assert record.delegation.credential_id == "cred-abc"
-
-
-def test_record_without_delegation_is_valid() -> None:
-    record = TrustRecord.model_validate(_load("intel-tdx.json"))
-    assert record.delegation is None
-
-
-def test_delegation_bad_digest_rejected() -> None:
-    data = _load("intel-tdx.json")
-    data["delegation"] = {"parent_record_hash": "not-a-digest", "credential_id": "c"}
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)
-
-
-def test_delegation_empty_credential_id_rejected() -> None:
-    data = _load("intel-tdx.json")
-    data["delegation"] = {"parent_record_hash": "sha256:" + "a" * 64, "credential_id": ""}
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)
-
-
-def test_delegation_extra_field_rejected() -> None:
-    data = _load("intel-tdx.json")
-    data["delegation"] = {
-        "parent_record_hash": "sha256:" + "a" * 64,
-        "credential_id": "c",
-        "foo": "bar",
-    }
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)
+
+
+def test_delegation_block_parses() -> None:
+    data = _load("intel-tdx.json")
+    data["delegation"] = {
+        "parent_record_hash": "sha256:" + "a" * 64,
+        "credential_id": "cred-abc",
+    }
+    record = TrustRecord.model_validate(data)
+    assert record.delegation is not None
+    assert record.delegation.credential_id == "cred-abc"
+
+
+def test_record_without_delegation_is_valid() -> None:
+    record = TrustRecord.model_validate(_load("intel-tdx.json"))
+    assert record.delegation is None
+
+
+def test_delegation_bad_digest_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["delegation"] = {"parent_record_hash": "not-a-digest", "credential_id": "c"}
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_delegation_empty_credential_id_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["delegation"] = {"parent_record_hash": "sha256:" + "a" * 64, "credential_id": ""}
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_delegation_extra_field_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["delegation"] = {
+        "parent_record_hash": "sha256:" + "a" * 64,
+        "credential_id": "c",
+        "foo": "bar",
+    }
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
diff --git a/tests/test_sign.py b/tests/test_sign.py
index 81ac9da..8b7ff22 100644
--- a/tests/test_sign.py
+++ b/tests/test_sign.py
@@ -22,7 +22,7 @@ def _b64url_decode(s: str) -> bytes:
 
 def _minimal_record() -> dict:
     return {
-        "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+        "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
         "iat": 1750000000,
         "subject": "did:mesh:spiffe://factory.example/agent/payments/prod",
         "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"},