fix(trace): emit the TRACE v0.2 profile URI

[Imran Siddique (imran-siddique)]

AGT emits tag:agentrust.io,2026:trace-v0.1 as its eat_profile constant. That identifier was never valid.

RFC 4151 permits a tag URI only where the minting authority controlled the named domain on the date in the URI. agentrust.io was never controlled by the TRACE project; it resolves to third-party parked addresses. So the identifier asserted authority over a name belonging to someone else, who could publish a conflicting definition at it at any time.

TRACE v0.2 corrects it to tag:agentrust-io.com,2026:trace-v0.2 and changes nothing else about the record format. No field added, removed, or re-typed, so AGT's side is one constant and its tests.

Upstream: agentrust-io/trace-spec#107, released as agentrust-trace 0.5.0 and agentrust-trace-tests 0.4.0.

Cutover, not a transition window

A v0.2 verifier requires the new URI and rejects the old one. A verifier accepting both would keep the invalid identifier live indefinitely, which is the thing being corrected.

Records AGT has already emitted do not become invalid retroactively: they are v0.1 records and remain verifiable against agentrust-trace-tests 0.3.x, which stays published.

ADR-0032

Amended rather than edited, per the ADR immutability convention in this repo. The original Decision text stays, and the file name keeps v01, with an amendment section recording why the constant changed. Same pattern as the existing amendments on ADR-0006.

Note

I have push and triage on this repo but cannot self-merge, so this needs a maintainer. Commit is DCO signed off.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

agent-governance-python/agent-governance-toolkit-core/pyproject.toml

Package	Version	License	Issue Type
agentrust-trace	>= 0.5.1,< 0.6.0	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, PSF-2.0, Python-2.0, 0BSD, Unlicense, CC0-1.0, CC-BY-4.0, Zlib, BSL-1.0, MPL-2.0, JSON, Unicode-3.0, CDLA-Permissive-2.0

Excluded from license check:

pkg:cargo/futures-timer

OpenSSF Scorecard

Package	Version	Score	Details
pip/agentrust-trace	>= 0.5.1,< 0.6.0	Unknown	Unknown

Scanned Files

• agent-governance-python/agent-governance-toolkit-core/pyproject.toml

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

Severity	Change	Impact
High	Updated eat_profile constant from tag:agentrust.io,2026:trace-v0.1 to tag:agentrust-io.com,2026:trace-v0.2.	Breaks compatibility with verifiers expecting the old URI.
High	Dependency agentrust-trace updated from >=0.2.0,<0.3.0 to >=0.5.1,<0.6.0.	Introduces breaking changes in canonicalization (RFC 8785) and verification behavior. Verifiers pinned to older versions must update.
High	transparency field in TrustRecord changed from str to Optional[str].	Breaks compatibility with consumers expecting a non-optional string.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

• TRACE_EAT_PROFILE in trace_model.py -- docstring present, no issue.
• README.md -- no evidence of outdated sections related to this change.
• CHANGELOG -- missing entry for the behavioral change regarding the TRACE profile URI update and dependency bump to agentrust-trace>=0.5.1,<0.6.0.

Please ensure the CHANGELOG includes this update.

[github-actions]

🤖 AI Agent: code-reviewer — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. Change is sound but requires downstream verifier updates.

#	Sev	Issue	Where
1	Warn	Breaking change: TRACE v0.2 canonicalization and verifier behavior require downstream updates.	Dependency bump to agentrust-trace>=0.5.1,<0.6.0

Action items: None (no blockers).

Warnings: fine as follow-up PRs.

[github-actions]

🤖 AI Agent: test-generator — `agent-mesh/src/agentmesh/governance/trace_model.py`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

agent-mesh/src/agentmesh/governance/trace_model.py

• test_trace_model_transparency_field -- Validate that the transparency field is correctly set to None for unanchored records.
• test_trace_model_eat_profile_constant -- Ensure the TRACE_EAT_PROFILE constant is correctly used across all relevant methods.

agent-mesh/src/agentmesh/governance/trace_sink.py

• test_trace_sink_transparency_field -- Verify that the transparency field is None in emitted trust records when not anchored.
• test_trace_sink_eat_profile_constant -- Confirm that the TRACE_EAT_PROFILE constant is correctly applied in emitted records.

agent-mesh/tests/governance/test_trace_model.py

• test_invalid_eat_profile_handling -- Test behavior when an invalid eat_profile is provided in the configuration.

agent-mesh/tests/governance/test_trace_sink.py

• test_emit_invalid_eat_profile -- Validate that the sink raises an appropriate error when emitting with an invalid eat_profile.
• test_emit_transparency_field_absence -- Ensure that emitted records without transparency logs correctly omit the transparency field.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[Copilot]

Pull request overview

TL;DR: 0 blockers, 1 warning (docs reference/formatting). Fine as a follow-up.

#	Sev	Issue	Where
1	Warn	ADR references/heading formatting drift from stated upstream versions	docs/adr/0032-...md

Updates AGT’s TRACE Trust Record emission to use the corrected TRACE v0.2 eat_profile tag URI, aligning emitted records and tests with the spec cutover described in ADR-0032.

Changes:

• Update emitted eat_profile constant to tag:agentrust-io.com,2026:trace-v0.2.
• Update unit tests asserting the emitted eat_profile.
• Amend ADR-0032 with rationale for the URI correction while preserving the original decision text.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
docs/adr/0032-agt-emits-trace-v01-trust-records.md	Adds an amendment explaining the v0.2 profile URI cutover and rationale.
agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py	Updates the emitted trust record eat_profile value.
agent-governance-python/agent-mesh/src/agentmesh/governance/trace_model.py	Updates the model config default eat_profile value.
agent-governance-python/agent-mesh/tests/governance/test_trace_sink.py	Updates sink/emission tests to assert the new profile URI.
agent-governance-python/agent-mesh/tests/governance/test_trace_model.py	Updates model mapping test to assert the new profile URI.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:93

• eat_profile is now hardcoded here, but the same URI is also hardcoded as the default in TraceModelConfig (trace_model.py). Having two independent literals for the same protocol identifier makes future cutovers easy to miss and can cause the two TRACE emission paths to diverge. Consider centralizing this into a single constant (or flowing it through config) and referencing it from both places.

    record: dict[str, Any] = {
        "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
        "iat": iat,

[github-actions]

📦 Dependency diff (SBOM)

Comparing main → fix/trace-v0.2-profile-uri.

✅ No dependency changes detected.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:93

• The TRACE profile URI is now hard-coded here, while TraceModelConfig (in trace_model.py) also carries an eat_profile default. Keeping the URI literal in multiple places increases drift risk the next time TRACE revises the identifier. Consider centralizing it as a single constant (and reusing it from both trace_sink.py and trace_model.py, plus tests).

    record: dict[str, Any] = {
        "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
        "iat": iat,

[MohammadHaroonAbuomar]

• The agentrust-trace >=0.5,<0.6 bump breaks CI on every leg: 4 tests in tests/governance/test_trace_sink.py fail with pydantic ValidationError because upstream now requires transparency min_length=1 while AGT still emits "transparency": "" at agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:120 and trace_model.py:98. Populate transparency with the spec-required value for no-registry emitters; this is what turns ci-complete/docker-compose-test/test(agent-mesh 3.11-3.13) green.
• docs/adr/0032-agt-emits-trace-v01-trust-records.md (amendment): disclose that the 0.2->0.5 library jump also adopts 0.3.0's BREAKING RFC 8785/JCS canonicalization: AGT records signed after this bump are not cross-verifiable with 0.2.0-era verifiers. "One constant and its tests" undersells the cutover, and CI falsifies it.

Minor:

• PR body says old records verify against agentrust-trace-tests 0.3.x while upstream #107 says agentrust-trace 0.4.x; align for precision. Also FYI: the SBOM-diff bot reported no dependency changes and missed the pyproject range bump, a repo tooling gap worth a separate look.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

docs/adr/0032-agt-emits-trace-v01-trust-records.md:187

• The amendment says the transparency=None change requires agentrust-trace 0.5.1+ (line 195), but the dependency bump in this amendment still states >=0.5.0,<0.6.0. This is internally inconsistent and could mislead readers about the minimum compatible version; align the stated range with the minimum actually required.

AGT's `agentrust-trace` dependency moves from `>=0.2.0,<0.3.0` to
`>=0.5.0,<0.6.0`.

agent-governance-python/agent-mesh/pyproject.toml:62

• The ADR amendment states transparency=None requires agentrust-trace 0.5.1+ (docs/adr/0032-agt-emits-trace-v01-trust-records.md:195-196). With the current lower bound >=0.5.0, installations could select 0.5.0 and fail validation at runtime if that version still requires a non-empty transparency. Bump the minimum to 0.5.1 to match the documented requirement.

    # TRACE Trust Record emission (ADR-0032)
    "agentrust-trace>=0.5.0,<0.6.0",

agent-governance-python/agent-governance-toolkit-core/pyproject.toml:54

• The ADR amendment states transparency=None requires agentrust-trace 0.5.1+ (docs/adr/0032-agt-emits-trace-v01-trust-records.md:195-196). With the current lower bound >=0.5.0, dependency resolution may choose 0.5.0 and break TRACE emission/validation if 0.5.0 still requires a non-empty transparency. Bump the minimum to 0.5.1 to match the documented requirement.

    "python-dateutil>=2.8.0,<3.0",
    "jsonschema>=4.0.0,<5.0",
    "agentrust-trace>=0.5.0,<0.6.0",
]

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_model.py:103

• tool_transcript.call_count is currently derived from only tool_invocation events (trace_model.py:83), but ADR-0032 defines it as “total number of entries in the chain” (docs/adr/0032-agt-emits-trace-v01-trust-records.md:61-63) and the TRACE sink implementation/test use the total entry count (trace_sink.py:110-111; test_trace_sink.py:106-113). This inconsistency means the two mappers produce different records for the same audit stream; please align call_count semantics across implementations.

        transparency=None,
        tool_transcript={"hash": _jcs_hash(entries), "call_count": call_count},

[MohammadHaroonAbuomar]

• agent-governance-python/agent-mesh/pyproject.toml: the ADR itself says transparency=None requires agentrust-trace 0.5.1+ (trace-spec#109), but both pyprojects still pin >=0.5.0,<0.6.0: a 0.5.0 resolve reintroduces the exact ValidationError this PR fixes. Bump the floor to >=0.5.1 in both.
• agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:188: stale install hint still says pip install agentrust-trace>=0.2.0.
• PR body: still claims "changes nothing else about the record format ... one constant and its tests", falsified by the branch's own transparency change; refresh.

Minor:

• the ADR disclosure is done and high quality, the transparency emitter fix landed at both sites and the agent-mesh legs are green; approve once the floor bump lands and the pending checks (docker-compose-test etc.) complete green.

[Imran Siddique (imran-siddique)]

MohammadHaroonAbuomar all three of your points are addressed and CI is fully green: 91 successes, no failures, no pending. ci-complete, docker-compose-test, test (agent-mesh, 3.11/3.12/3.13), the cooling-off and audit gates, and DCO all pass.

1. transparency: "" breaking every leg. Fixed at both sites you named, trace_sink.py:120 and trace_model.py:98. Emitting None rather than a populated value, because the root cause was upstream: agentrust-trace was requiring a non-empty URI at every level while schema/trace-claim.json sets no minLength and the conformance suite runs TR-ANC at Level 2 only, where its own message reads "required at Level 2". So the library was stricter than both of the spec's other normative artifacts, and an unanchored Level 0/1 record was unrepresentable. Relaxed upstream in agentrust-io/trace-spec#109, released as agentrust-trace 0.5.1, which this branch's existing >=0.5.0,<0.6.0 pin picks up. Empty string stays rejected there deliberately: "" is not a URI, and a field that looks populated but resolves to nothing is worse in a trust record than an absent one.

2. The 0.3.0 canonicalization break. You were right and I was wrong. "One constant and its tests" was accurate about the specification change and false about the library jump. The ADR amendment now discloses that 0.2.0 to 0.5.x crosses 0.3.0's BREAKING move to RFC 8785 (JCS), so records AGT signs after this bump are not cross-verifiable with 0.2.0-era verifiers, since the signature covers a different byte sequence. I added a second consequence you did not mention: 0.3.0 also stopped self-verifying from the embedded cnf.jwk by default, so anything verifying AGT records by trusting the key inside them needs updating too. 0.4.0 is additive only and imposes nothing.

3. Version references. These were two different packages rather than an inconsistency: the library agentrust-trace 0.4.x still accepts the v0.1 profile, and the conformance suite agentrust-trace-tests 0.3.x still requires it. Fair to have flagged it, since citing one of each read as a contradiction. The ADR now names both explicitly, with a pointer to the canonicalization caveat, because a record signed under 0.2.0 needs a 0.2.0-era verifier rather than merely a pre-cutover one.

4. SBOM-diff bot missing the pyproject range bump. Agreed that is a repo tooling gap and worth its own issue rather than riding along here.

Any chance you could take a look and merge before the MCP Release Party today? I cannot self-merge here. Happy to keep iterating if anything above does not sit right, and no rush intended if today does not work.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (8)

docs/adr/0032-agt-emits-trace-v01-trust-records.md:191

• The amendment says the dependency moves to >=0.5.0,<0.6.0, but later in the same amendment it says 0.5.1+ is required. Update this minimum version so the amendment is internally consistent.

AGT's `agentrust-trace` dependency moves from `>=0.2.0,<0.3.0` to
`>=0.5.0,<0.6.0`.

agent-governance-python/agent-mesh/tests/governance/test_trace_sink.py:176

• Since this PR changes emitted records to use transparency=None, it would be good for the integration-style emit test to assert the serialized JSON contains null for transparency (not an empty string). This protects the on-disk wire output from silently drifting.

    def test_emit_file_is_valid_trust_record(self, tmp_path):
        log = _make_audit_log()
        cfg = TraceConfig(str(tmp_path) + "/")
        sink = TRACEAuditSink(cfg, _AGENT_DID, _policy_hash(_POLICY_YAML))
        path = sink.emit(log)
        data = json.loads(Path(path).read_text())
        assert data["eat_profile"] == "tag:agentrust-io.com,2026:trace-v0.2"
        assert data["subject"] == _AGENT_DID

docs/adr/0032-agt-emits-trace-v01-trust-records.md:149

• The earlier “Implementation” section still says the runtime dependency is agentrust-trace>=0.2.0 (line 97), which is now out of date after this cutover. Please update that bullet too so the ADR doesn’t give two different minimum versions.

## Amendment 2026-07-28: the profile URI moves to TRACE v0.2

**Resolved by:** agentrust-io/trace-spec#107.

The Decision section above specifies `eat_profile` as the constant
`"tag:agentrust.io,2026:trace-v0.1"`. That URI is no longer correct, and it was
never valid.

agent-governance-python/agent-mesh/pyproject.toml:62

• The ADR amendment in this PR states TRACE emission needs agentrust-trace 0.5.1+ (because 0.5.1 relaxed the transparency requirement), but the dev dependency range still allows 0.5.0. If 0.5.0 is installed, TRACE emission/validation may fail at runtime.

    # TRACE Trust Record emission (ADR-0032)
    "agentrust-trace>=0.5.0,<0.6.0",

agent-governance-python/agent-governance-toolkit-core/pyproject.toml:53

• This package dependency range allows agentrust-trace 0.5.0, but the ADR amendment added in this PR says 0.5.1+ is required for Level 0/1 records with transparency=None. To avoid installing a version that rejects emitted records, bump the lower bound to 0.5.1.

    "python-dateutil>=2.8.0,<3.0",
    "jsonschema>=4.0.0,<5.0",
    "agentrust-trace>=0.5.0,<0.6.0",
]

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:189

• The RuntimeError install hint suggests agentrust-trace>=0.5.0, but this PR also changes emitted records to use transparency=None and the ADR amendment says that requires 0.5.1+. Suggest updating the hint so users don't install a version that may reject emitted records.

            raise RuntimeError(
                "agentrust-trace is required for TRACE emission. "
                "Install it with: pip install 'agentrust-trace>=0.5.0,<0.6.0'"
            ) from exc

docs/adr/0032-agt-emits-trace-v01-trust-records.md:139

• This paragraph says the current pin is >=0.5.0,<0.6.0, but a few lines later the amendment states TRACE emission needs agentrust-trace 0.5.1+. These should be consistent to avoid readers installing an incompatible minimum version.

This issue also appears on line 190 of the same file.

  That is the version this ADR was accepted against, kept as the historical record.
  Do not install it: the current pin is `>=0.5.0,<0.6.0`, and the 2026-07-28
  amendment below explains what changed in between, including a breaking
  canonicalization change.

agent-governance-python/agent-mesh/tests/governance/test_trace_sink.py:75

• TRACE emission now sets transparency to None (null in JSON). The updated tests only assert the new eat_profile, so they won’t catch a regression back to the empty-string value described in ADR-0032. Add an explicit assertion here to lock in the new behavior.

This issue also appears on line 168 of the same file.

    def test_eat_profile_sentinel(self):
        log = _make_audit_log()
        record = session_to_trust_record(
            _AGENT_DID, log, _policy_hash(_POLICY_YAML), TraceConfig("./out/")
        )
        assert record["eat_profile"] == "tag:agentrust-io.com,2026:trace-v0.2"

[Imran Siddique (imran-siddique)]

All five inline comments addressed in 9abe5eb0. CI green again: 91 successes, no failures, ci-complete passing.

Profile URI hoisted into one constant (MohammadHaroonAbuomar and Copilot both raised this). TRACE_EAT_PROFILE now lives in trace_model.py and trace_sink.py imports it. Your framing was the persuasive part: this PR had to edit six literals to move one value, which is the drift cost demonstrated rather than argued.

One deliberate exception: the tests still assert the literal string rather than importing the constant. A test comparing against the constant would pass even if the constant were changed wrongly, and for a wire-format value that is the one place a hardcoded copy earns its keep.

Stale install guidance fixed. trace_sink.py still told users pip install agentrust-trace>=0.2.0, which after the pin bump names a version that cannot satisfy the dependency, so a missing-package error would have been followed by a confusing second failure. It now names the real range.

Amendment heading normalized. Copilot flagged the double-spaced separator as a typo. I initially thought it was house style and reverted an autofix that changed it, which was my error: that convention is in agent-manifest, not here. In this repo it was the only heading of its kind, so it is now normalized.

References entry to agentrust-trace v0.2.0: annotated rather than rewritten. Copilot raised this twice and the underlying concern is right, that a reader should not be pointed at a version they cannot install. I did not change the version itself, because that line records what this ADR was accepted against and rewriting it would assert the ADR was accepted against a release that did not exist at the time. Instead it now says plainly that it is the historical version, not to install it, the current pin is >=0.5.0,<0.6.0, and to see the amendment for what changed in between. If you would rather see the number simply updated, say so and I will do that instead.

The SBOM-diff bot gap you noted is untouched here and worth its own issue.

Still hoping to land this before the MCP Release Party if you get a window. Everything is green and I cannot self-merge.

[MohammadHaroonAbuomar]

Minor:

• the constant hoist and install-guidance rewrite landed, and CI is now settled green; this is the last blocking item.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_model.py:17

• The module doc comment says the “single source of truth” is trace_sink.py, but TRACE_EAT_PROFILE is defined here and imported by trace_sink.py (and used as the default for TraceModelConfig). This is backwards/misleading for future maintainers.

#: TRACE EAT profile URI emitted by AGT. Single source of truth: trace_sink.py
#: imports this rather than repeating the literal, because a wire-format constant
#: duplicated across modules drifts one call site at a time. See ADR-0032 and its
#: 2026-07-28 amendment for why the v0.1 URI was replaced.

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:125

• The PR description states AGT’s change is “one constant and its tests” because TRACE v0.2 “changes nothing else”, but this hunk also changes the emitted record content (transparency from "" to null/None). That’s an observable wire-format change for AGT emitters/consumers and should be explicitly called out in the PR title/description (or reverted if truly out of scope).

        # None, not "": this sink does not anchor to a transparency log, so there
        # is no receipt URI. An empty string looks populated and resolves to
        # nothing. Conformance requires this at Level 2 only, where TR-ANC runs.
        "transparency": None,
    }

[Imran Siddique (imran-siddique)]

Good catch, and it was a real defect rather than a nit. Fixed in 24ae2c39, CI green: 92 successes, no failures, ci-complete and DCO passing, rollup clear.

You were right that a 0.5.0 resolve reintroduces the exact failure. I verified it rather than taking it on faith, installing each version in a clean venv:

agentrust-trace 0.5.0  ->  model_validate rejects transparency=None
agentrust-trace 0.5.1  ->  accepts transparency=None

So the floor was admitting a version that cannot run this code. CI passed only because it happened to resolve the latest, which is exactly the kind of green that hides a broken constraint from anyone installing later.

Raised to >=0.5.1,<0.6.0 in both agent-mesh and agent-governance-toolkit-core, and in the install hint at trace_sink.py:189, which quoted the same too-low range as you noted.

I also moved the ADR's two statements of the pin, since one of them still said >=0.5.0 while another paragraph said 0.5.1 or later was required, which is the contradiction you spotted from the outside. The amendment now records why the floor is 0.5.1: 0.5.0 still required a non-empty transparency, and a floor that admits a broken version is not a floor. That is there so the next person reading it does not relax it back to 0.5.0 as a tidy-up.

That should be everything. Ready when you are, and still hoping for the party window.

[Copilot]

Review details

Comments suppressed due to low confidence (1)

agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py:190

• The pip install command in the RuntimeError uses single quotes. That works in POSIX shells/PowerShell, but not in Windows cmd.exe where single quotes are treated literally, leading to install failures if users copy/paste the message. Prefer double quotes for cross-shell compatibility (the quotes are still needed to prevent </> redirection in POSIX shells).

            raise RuntimeError(
                "agentrust-trace is required for TRACE emission. "
                "Install it with: pip install 'agentrust-trace>=0.5.1,<0.6.0'"
            ) from exc

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Low