agentrust-io · imran-siddique · Jul 28, 2026 · Jul 28, 2026
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -8,7 +8,7 @@ labels: bug
 <!-- Describe the problem. Quote the specific text or schema path. -->
 
 **Spec section or file**
-<!-- e.g. spec/trace-v0.1.md §3.2.1, schema/trace-claim.json #/properties/runtime -->
+<!-- e.g. spec/trace-v0.2.md §3.2.1, schema/trace-claim.json #/properties/runtime -->
 
 **Expected behavior**
 <!-- What should it say or do? -->

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -12,7 +12,7 @@
 
 ## Spec section
 
-<!-- Which section(s) of spec/trace-v0.1.md does this affect? -->
+<!-- Which section(s) of spec/trace-v0.2.md does this affect? -->
 
 ## Checklist
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,18 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR.
 
 ## [Unreleased]
 
+### Changed
+
+- **BREAKING: TRACE v0.2 changes the EAT profile URI to `tag:agentrust-io.com,2026:trace-v0.2`** (was `tag:agentrust.io,2026:trace-v0.1`). `agentrust.io` was never a domain this project controlled; it resolves to third-party parked addresses. RFC 4151 permits a tag URI only where the minting authority controlled the named domain on the stated date, so the v0.1 identifier was invalid rather than merely misspelled: it asserted authority over a name someone else could stand up a conflicting definition at.
+
+  **Cutover, not coexistence.** A v0.2 verifier requires the new URI and rejects the old one; it does not accept both. Dual acceptance would keep the invalid identifier live indefinitely, which is the thing being fixed. Records already issued under v0.1 stay verifiable against `spec/trace-v0.1.md` and the published `agentrust-trace` 0.4.x releases, which remain on PyPI. They are v0.1 records and are read as such.
+
+  Nothing else in the record format changed. No field was added, removed, or re-typed, so migration for a producer is the profile string and a dependency bump.
+
+  Moved together: `spec/trace-v0.2.md` (new, with a "Changes from v0.1" section), `spec/trace-v0.1.md` (retained, marked superseded), the root `schema/trace-claim.json` const, the packaged `agentrust_trace/schema/trace-v0.2.json`, the `eat_profile` `Literal` in `models.py`, the AGT adapter, `validate.py`'s schema resource, the four platform example records, and the docs.
+
+- Other `agentrust.io` URLs moved to `agentrust-io.com`: the registry and verifier hosts in the AGT adapter and the schema `$id`.
+
 ## [0.4.0]
 
 ### Added

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -16,7 +16,7 @@ This adds `Signed-off-by: Your Name <you@example.com>`. PRs without DCO sign-off
 
 ### Spec changes (normative text)
 
-Changes to `spec/trace-v0.1.md` that affect what implementations must do.
+Changes to `spec/trace-v0.2.md` that affect what implementations must do.
 
 1. Open a GitHub issue using the **Spec change proposal** template. Describe the problem, the proposed change, and the spec section affected.
 2. Allow 5 business days for comment. Changes touching wire format, cryptographic algorithms, or Trust Record required fields require 14 days.

diff --git a/README.md b/README.md
@@ -11,7 +11,7 @@
 </p>
 
 <p align="center">
-  <a href="spec/trace-v0.1.md">Specification</a> &nbsp;|&nbsp;
+  <a href="spec/trace-v0.2.md">Specification</a> &nbsp;|&nbsp;
   <a href="schema/trace-claim.json">Schema</a> &nbsp;|&nbsp;
   <a href="examples/">Examples</a> &nbsp;|&nbsp;
   <a href="https://github.com/agentrust-io/trace-registry">Registry</a> &nbsp;|&nbsp;
@@ -20,7 +20,7 @@
 </p>
 
 [![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
-[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.1.md)
+[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.2.md)
 [![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/)
 [![CI](https://github.com/agentrust-io/trace-spec/actions/workflows/ci.yml/badge.svg)](https://github.com/agentrust-io/trace-spec/actions/workflows/ci.yml)
 [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white&style=flat)](https://discord.gg/grgzFEHgkj)
@@ -54,7 +54,7 @@ signed = sign_record(record, key=signing_key)
 | | |
 |---|---|
 | 📖 Full documentation | [trace.agentrust-io.com](https://trace.agentrust-io.com) |
-| 📄 Specification | [spec/trace-v0.1.md](spec/trace-v0.1.md) |
+| 📄 Specification | [spec/trace-v0.2.md](spec/trace-v0.2.md) |
 | 🔍 Schema | [schema/trace-claim.json](schema/trace-claim.json) |
 | 📦 PyPI | [agentrust-trace](https://pypi.org/project/agentrust-trace/) |
 | 🧪 Test suite | [trace-tests](https://github.com/agentrust-io/trace-tests) |
@@ -91,7 +91,7 @@ TRACE is the evidence format. AGT and cMCP produce and consume Trust Records, so
 
 ### What is the current status of TRACE?
 
-The current specification is TRACE v0.1, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.
+The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.
 
 <script type="application/ld+json">
 {
@@ -143,7 +143,7 @@ The current specification is TRACE v0.1, published with a conformance test suite
       "name": "What is the current status of TRACE?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "The current specification is TRACE v0.1, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production."
+        "text": "The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production."
       }
     }
   ]

diff --git a/docs/crosswalks/owasp-agentic-top-10.md b/docs/crosswalks/owasp-agentic-top-10.md
@@ -1,16 +1,16 @@
 # OWASP Agentic AI Top 10 Evidence Cross-walk
 
-> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.1 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.1 Trust Record as defined in [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md).
+> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.2 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.2 Trust Record as defined in [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md).
 
 ---
 
 ## Purpose
 
 OWASP's Agentic AI Top 10 (ASI01–ASI10) names the principal risk categories for autonomous AI agents. TRACE is an evidence and attestation layer: it does not prevent these risks, but it produces verifiable, hardware-rooted records that support audit, incident review, and governance verification after or during execution.
 
-This page answers a concrete question for each OWASP risk: which TRACE Trust Record claims carry relevant evidence, what that evidence actually proves, and where TRACE v0.1 leaves a gap that a future profile would need to close.
+This page answers a concrete question for each OWASP risk: which TRACE Trust Record claims carry relevant evidence, what that evidence actually proves, and where TRACE v0.2 leaves a gap that a future profile would need to close.
 
-Field names are exact TRACE v0.1 claim names as specified in §3.1 of the spec. Sub-field references such as `policy.bundle_hash`, `runtime.platform`, and `appraisal.status` refer to the nested fields shown in the §3.2 wire-format example.
+Field names are exact TRACE v0.2 claim names as specified in §3.1 of the spec. Sub-field references such as `policy.bundle_hash`, `runtime.platform`, and `appraisal.status` refer to the nested fields shown in the §3.2 wire-format example.
 
 ---
 
@@ -23,8 +23,8 @@ Field names are exact TRACE v0.1 claim names as specified in §3.1 of the spec.
 | **ASI03: Identity and Privilege Abuse** | `subject`, `cnf`, `signature`, `runtime`, `policy`, `appraisal` | `subject` carries the SPIFFE SVID binding workload identity to a TEE-held key; `cnf` binds the signing key to the TEE via the hardware measurement in `runtime`; `appraisal.status` records the verifier's judgment of the evidence against policy; `policy.bundle_hash` shows what authorization rules were bound. Together these allow a verifier to confirm that the claimed identity corresponded to a genuine, measured workload at record issuance time. | Does not replace IAM or RBAC systems. Does not prove that external permissions granted to the workload were correctly scoped. Does not cover lateral movement or privilege escalation that occurred at infrastructure layers outside the TEE boundary. | Delegation profile fields for scoped credentials, audience restriction, purpose binding, and per-action authorization evidence. |
 | **ASI04: Agentic Supply Chain Vulnerabilities** | `build_provenance`, `model`, `runtime`, `transparency`, `appraisal` | `build_provenance.slsa_level`, `build_provenance.builder`, and `build_provenance.digest` bind build-time provenance to the running workload; `model.weights_digest` and `model.model_id` bind the model artifact; `runtime.measurement` and `runtime.rim_uri` bind the runtime image to vendor-published Reference Integrity Manifests; `transparency` provides an append-only anchor for the full record. | Does not enumerate every transitive dependency. Does not detect malicious code that was present at build time but is not reflected in measurement divergence. Does not prove model behavior is safe -- only that the identified artifact was the one that executed. | Richer AIBOM/SBOM linkage in the `model` sub-claim; vendor platform annexes specifying per-silicon supply-chain appraisal criteria. |
 | **ASI05: Unexpected Code Execution** | `runtime`, `build_provenance`, `tool_transcript`, `policy`, `appraisal` | `runtime.measurement` shows what workload and container digest were loaded; `build_provenance.digest` and `build_provenance.slsa_level` bind the build artifact; `tool_transcript.hash` captures tool invocations at protocol boundaries; `appraisal.status` records whether the verifier accepted the runtime evidence against current RIMs. | Does not prevent code execution. Does not prove no code ran outside the recorded `tool_transcript` scope: inline code execution embedded in the workload binary is not captured at invocation granularity by v0.1 claims. | Tool and code-execution profile: sandbox identity, command execution transcript hash, filesystem and network boundary evidence per invocation. |
-| **ASI06: Memory and Context Poisoning** | `model`, `data_class`, `tool_transcript`, `build_provenance`, `transparency` | `model.model_id` and `model.weights_digest` identify the model artifact; `data_class` records the sensitivity classification applied to inputs and outputs; `tool_transcript.hash` captures context-retrieval calls that crossed an instrumented boundary; `build_provenance.digest` binds the build artifact that includes any vector-store or RAG client code. | TRACE v0.1 does not bind memory snapshots, RAG corpus roots, embedding-store contents, or poisoning scan results. Context provenance -- where retrieved chunks originated and whether they were validated -- is not a v0.1 claim. | Memory and RAG profile: context source hashes, corpus Merkle roots, poisoning scan status, namespace and tenant boundary evidence. |
-| **ASI07: Insecure Inter-Agent Communication** | `subject`, `cnf`, `signature`, `runtime`, `tool_transcript`, `transparency` | `subject` and `cnf` establish and bind workload identity for each participating agent; `signature` (or the enveloping-signature equivalent) proves record integrity; `runtime.measurement` binds the TEE that produced the record; `tool_transcript.hash` anchors the inter-agent call transcript; `transparency` anchors the record in an append-only log accessible to any verifier. | TRACE v0.1 does not define a normative A2A profile. Message-level semantic validation, nonce binding per message, and delegation chain records across multiple hops are not v0.1 claims. | A2A profile: peer agent identity, per-message hash, audience restriction, nonce, delegation chain, and protocol version binding. |
+| **ASI06: Memory and Context Poisoning** | `model`, `data_class`, `tool_transcript`, `build_provenance`, `transparency` | `model.model_id` and `model.weights_digest` identify the model artifact; `data_class` records the sensitivity classification applied to inputs and outputs; `tool_transcript.hash` captures context-retrieval calls that crossed an instrumented boundary; `build_provenance.digest` binds the build artifact that includes any vector-store or RAG client code. | TRACE v0.2 does not bind memory snapshots, RAG corpus roots, embedding-store contents, or poisoning scan results. Context provenance -- where retrieved chunks originated and whether they were validated -- is not a v0.1 claim. | Memory and RAG profile: context source hashes, corpus Merkle roots, poisoning scan status, namespace and tenant boundary evidence. |
+| **ASI07: Insecure Inter-Agent Communication** | `subject`, `cnf`, `signature`, `runtime`, `tool_transcript`, `transparency` | `subject` and `cnf` establish and bind workload identity for each participating agent; `signature` (or the enveloping-signature equivalent) proves record integrity; `runtime.measurement` binds the TEE that produced the record; `tool_transcript.hash` anchors the inter-agent call transcript; `transparency` anchors the record in an append-only log accessible to any verifier. | TRACE v0.2 does not define a normative A2A profile. Message-level semantic validation, nonce binding per message, and delegation chain records across multiple hops are not v0.1 claims. | A2A profile: peer agent identity, per-message hash, audience restriction, nonce, delegation chain, and protocol version binding. |
 | **ASI08: Cascading Failures** | `tool_transcript`, `transparency`, `subject`, `appraisal`, `policy` | `tool_transcript.hash` and `tool_transcript.call_count` provide a bounded activity record for post-incident traceability; `subject` identifies the workload at each hop where a Trust Record was issued; `appraisal.status` and `appraisal.verifier` record the verification outcome; `policy.bundle_hash` shows what controls were bound; `transparency` provides an auditable anchor for reconstructing the sequence of records. | Does not itself detect cascade conditions, stop propagation, or reconstruct full multi-agent lineage unless every participating agent issued Trust Records and those records are correlated at analysis time. Lineage reconstruction requires out-of-band tooling. | Workflow provenance profile: parent/child record references, propagation lineage identifiers, blast-radius counters, and circuit-breaker event records. |
 | **ASI09: Human-Agent Trust Exploitation** | `tool_transcript`, `policy`, `data_class`, `transparency`, `appraisal` | `tool_transcript.hash` records the set of actions the agent took at protocol boundaries; `policy.bundle_hash` and `policy.enforcement_mode` show what rules were in force; `data_class` records the sensitivity class of data involved; `appraisal.status` provides the verifier's assessment; `transparency` anchors the record for independent audit. Collectively these support a post-incident review of what the agent was authorized to do and what it did. | Does not prove what a human was shown in the UI, whether the explanation was accurate, or whether informed consent was obtained. Does not detect social engineering at the human layer. | HITL (human-in-the-loop) evidence profile: approval record, reviewer identity, hash of displayed risk summary, and human decision evidence bound into the Trust Record. |
 | **ASI10: Rogue Agents** | `subject`, `runtime`, `cnf`, `signature`, `policy`, `tool_transcript`, `appraisal`, `transparency` | The full v0.1 claim set combines hardware-bound identity (`subject`, `cnf`), measured execution environment (`runtime`), policy binding (`policy.bundle_hash`, `policy.enforcement_mode`), tool activity (`tool_transcript`), verifier judgment (`appraisal.status`), and transparency anchoring (`transparency`) into one signed, independently verifiable record. A verifier can confirm that the agent presenting this record ran as a measured, policy-bound workload with a TEE-rooted identity at the stated time. | Does not determine behavioral intent. Does not detect rogue behavior that remained within the boundary of recorded claims. A workload can issue a valid Trust Record and still behave in ways the record does not constrain at inference time. | Behavioral integrity profile: declared capability manifest hash, expected tool set, execution baseline hash, and anomaly or quarantine event records. |
@@ -39,7 +39,7 @@ The table above surfaces per-risk scope boundaries. These apply across all ten r
 
 **TRACE does not adjudicate model behavior.** As stated in §2.4 of the spec, prompt injection, jailbreaks, hallucination, and alignment drift are permanent scope boundaries. TRACE proves what model artifact executed and what countermeasures were bound; it does not evaluate whether the model's output was correct or intended.
 
-**TRACE v0.1 does not cover intra-binary execution.** `tool_transcript` captures invocations crossing an instrumented protocol boundary (MCP, A2A, or equivalent). Code paths executed inside the deployed binary -- including embedded tool dispatch, in-process memory reads, or direct API calls -- are bound only by `build_provenance` and `model`, not at invocation granularity.
+**TRACE v0.2 does not cover intra-binary execution.** `tool_transcript` captures invocations crossing an instrumented protocol boundary (MCP, A2A, or equivalent). Code paths executed inside the deployed binary -- including embedded tool dispatch, in-process memory reads, or direct API calls -- are bound only by `build_provenance` and `model`, not at invocation granularity.
 
 **TRACE does not replace IAM, RBAC, or network controls.** `subject` and `cnf` establish and bind workload identity, but the permissions granted to that identity by external systems are outside the Trust Record. A correctly identified workload can still hold excessive privileges.
 
@@ -60,6 +60,6 @@ The MITRE ATLAS cross-walk (a separate v0.2 item) will address tactics and techn
 ## References
 
 - OWASP Agentic AI Top 10: <https://genai.owasp.org/>
-- TRACE v0.1 specification: [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md)
+- TRACE v0.2 specification: [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md)
 - TRACE roadmap: [`ROADMAP.md`](../../ROADMAP.md)
 - MITRE ATLAS: <https://atlas.mitre.org/>
diff --git a/docs/glossary.md b/docs/glossary.md
@@ -60,7 +60,7 @@ A numeric value (0, 1, or 2) that summarizes the strength of the guarantees carr
 ---
 
 **Trust Record**
-A signed JSON document emitted by an AI agent at the end of a governed session. It asserts the agent's identity, model, policy, data class, tool invocations, and (at Level 1+) hardware attestation state. Defined in full in the [TRACE Specification](../spec/trace-v0.1.md).
+A signed JSON document emitted by an AI agent at the end of a governed session. It asserts the agent's identity, model, policy, data class, tool invocations, and (at Level 1+) hardware attestation state. Defined in full in the [TRACE Specification](../spec/trace-v0.2.md).
 
 ---
 

diff --git a/docs/index.md b/docs/index.md
@@ -23,9 +23,9 @@ TRACE defines the format, anchoring protocol, and verification rules for cryptog
 
 -   :material-file-document: **Specification**
 
-    The normative TRACE v0.1 specification — envelope format, claim types, signing rules, and verification algorithm.
+    The normative TRACE v0.2 specification — envelope format, claim types, signing rules, and verification algorithm.
 
-    [Read the spec →](../spec/trace-v0.1.md)
+    [Read the spec →](../spec/trace-v0.2.md)
 
 -   :material-connection: **Integration**
-Original file line number
+Diff line change
@@ Expand Up @@
     ---
     **Trust Record**
-    A signed JSON document emitted by an AI agent at the end of a governed session. It asserts the agent's identity, model, policy, data class, tool invocations, and (at Level 1+) hardware attestation state. Defined in full in the [TRACE Specification](../spec/trace-v0.1.md).
+    A signed JSON document emitted by an AI agent at the end of a governed session. It asserts the agent's identity, model, policy, data class, tool invocations, and (at Level 1+) hardware attestation state. Defined in full in the [TRACE Specification](../spec/trace-v0.2.md).
     ---
@@ Expand Down @@