test: released cMCP/cA2A remote peer and TRACE software evidence for #199

[altrudev]

About and scope

Bounded released-protocol integration for #199.
This PR adds a software-only, same-operator live cMCP → cA2A → Conduit →
TRACE experiment with adversarial tests and reproducible signed evidence.
It does not claim hardware/TEE assurance, independently operated custody,
protected inference, or complete Issue #199 composed acceptance.

Implemented and verified

• Actual published cmcp-runtime==0.7.0 gateway authorization before any dispatch.
• Actual published ca2a-runtime==0.4.0 remote peer verification of an
  Ed25519-signed delegation and challenge-bound holder-possession proof,
  trusted issuer and local scope. Persisted single-use challenge replay ledger.
• Restricted forced-command SSH transport to a separately configured VPS;
  no new internet-facing port and no general SSH shell. Only a fixed
  network-disabled Frequency Conduit inspect job is dispatched.
• Remote cA2A authenticated response bound to exact transaction/request
  and Conduit execution result; lost post-execution responses stay unknown.
• VPS-originated TRACE v0.2 Level 0 software-only signed record plus
  separately signed evidence manifest. The policy field remains a policy hash.
• Offline packet verifier and published nonconfidential signed sample at
  integrations/agentrust-confidential-workflow-harness/evidence/live-software-20261016.json.
• Positive and negative tests for untrusted issuer, holder substitution,
  capability substitution, altered request, MAC tampering, TRACE signer
  substitution, missing trust root, consumed challenge replay, expired delegation, uncertain
  delivery, and historical offline-signature replay.
• SHA-256 hash-locked dependency closure, About, explicit licensing/IP
  attribution boundaries, and glossary mapping custom terms to standard
  terminology.

Evidence

• 81/81 tests pass on Prometheus and a separate VPS installation.
• 11/11 bounded live two-host adversarial cases pass on October 16, 2026.
• One real signed TRACE Level 0 example re-verifies offline with pins
  (fixture digest 402a8f0cc05bc517d2918e7a49b10051cb60122fcac8909f1a9ed308c12fdc13).
• Upstream validation, security and lint checks must pass on the exact head
  before approval.

See software acceptance record,
remote peer/About/security boundaries,
and replay instructions.

Deliberately still OPEN on Issue #199

This is a first-party software acceptance pilot, not an independently
certified confidential workflow. Production-grade revocation snapshots,
actual protected inference and confidential disclosure, hardware attestation
and key release, independently controlled issuers/peer observers, independent
cross-organization replay and current-head maintainer approval remain separate
requirements. No synthetic or same-operator evidence has been promoted to
hardware/independent assurance.

Review request: @dinakarjs please run the committed offline fixture,
unit/mutation suite and the paired acceptance/refusal matrix against this
exact head, and report independently observed results or discrepancies.
The signing keys' provenance is self-asserted in this public fixture and
must not be treated as externally enrolled just because its signatures verify.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Independent bounded review at bf9e4e5, Linux/Python 3.12.14, requirements/confidential-workflow-probe.txt installed with --require-hashes. All 66 committed harness unittest cases pass. An additional independent local selection passes 21 cases (11 existing remote controls plus 10 new controls): unapproved repository; missing holder proof; wrong holder with freshly generated proof; correctly signed expired credential and holder proof; correctly MACed expired challenge; replay-store failure; lost response after actual mocked dispatch with no retry and persistent replay refusal; correctly authenticated response with wrong nonce; validly signed TRACE companion describing different execution; and missing TRACE bundle when a pinned signing key is required.

Three isolated process-only mutations are detected by the existing remote tests: bypass remote handle_peer_request => untrusted issuer test fails; bypass persistent _consume => replay test fails; bypass verify_bundle => wrong TRACE signer test fails. No mutation was committed. Positive round-trip/TRACE controls pass on original code. No blocking defect found within this tested software scope.

The new remote modules go beyond the earlier 4842ca1 checkpoint: remote service verifies issuer/holder/request binding, consumes the challenge before dispatch and authenticates the response; the optional TRACE path pins the signing key and separately binds execution facts. Local review uses injected dispatch and in-process transport. I did not contact the operator's hosts, inspect deployment/SSH configuration or reproduce the claimed live run. These results establish neither independent operator custody, signed revocation, hardware attestation nor complete Issue #199 acceptance. Keep #199 open and preserve draft/maintainer gates. The PR description still describes the older zero-dispatch probe; please refresh it to this frozen head and the precise software-only scope before requesting acceptance.

[dinakarjs]

Independent review at e3e3eca, Linux/Python 3.12.14 with the hash-locked released probe dependencies.

Reproduced: 78/78 committed unittest cases pass; published packet SHA-256 is exactly 402a8f0cc05bc517d2918e7a49b10051cb60122fcac8909f1a9ed308c12fdc13; the documented CLI verifies it and reports record hash sha256:f830659f2af40ff74a42b48e04b1a6c544c41f25e9863c18aae56adc70ff77a5, software-only, historical-signature-only, independent_custody=false, hardware_attested=false and origin MAC not offline replayable.

Fourteen additional independent local controls pass (the previous ten plus four new controls): remote repository/holder/expiry/store-failure boundaries; correctly authenticated wrong nonce; signed TRACE execution substitution; missing required TRACE; response loss after dispatch with no retry; malformed inner TRACE signature with a freshly valid companion signature; historical replay accepted while live-age validation refuses the old record; evidence-export failure after one dispatch; and reuse of a consumed challenge in a fresh authenticated response occurrence. Six isolated mutation trials were detected: remote delegation bypass, replay-store bypass, live TRACE verification bypass, offline bundle bypass, inner TRACE-signature bypass, and reject-all verifier against a positive control. No mutation committed.

One evidence-reporting correction is required before accepting the claimed matrix: run_remote_ca2a_matrix.py's final one-time-challenge-replay case sets observed='authenticated-peer-denial' solely from repeated.get('status') == 403. It never checks the returned cA2A envelope/MAC for that repeated request. A transport-returned status is insufficient to establish the specific authenticated-response claim. Either label this row as an observed status-only denial and preserve the limitation, or add a fresh PendingResponse occurrence with a holder proof bound to the same already-consumed challenge and authenticate its 403 normally. I independently exercised the latter approach in-process: first occurrence accepted, fresh occurrence with the consumed challenge returns refused-authenticated-peer, and dispatch count remains one. Retain exact old-envelope replay as a separate status-only control if desired. This does not report a replay bypass in the service; it concerns what the live matrix establishes.

Nonblocking scope clarification: replay_export's packet.peer_public_key is outside the signed manifest. Relabelling it and supplying that new expected peer pin leaves the signed TRACE/manifest valid. Issuer binding is signed through policy_digest, but channel-key attribution is metadata equality only. Either explicitly report that limit or bind the channel key into the signed companion with a substitution twin. This is not an Ed25519 signature forgery or proof that the cA2A live MAC was bypassed.

Independent OFFLINE signature replay is now completed. I did not access either operator host, authenticate key provenance through a separate channel, inspect forced-command deployment, or reproduce the 10 live cases. Leave independent live/cross-organization custody, revocation, confidential execution, hardware gates and Issue #199 open. The software evidence should not be promoted beyond these observed checks.

[dinakarjs]

@altrudev the evidence-reporting correction is now a concrete supplemental draft for your existing PR: dinakarjs#5 at caccdee, based directly on 21ec990. It relabels exact-envelope replay as a status-only observation with response_authentication=not-verified, adds peer_channel_binding=metadata-only-not-signed to the offline result, and documents both limits without changing the captured packet/signatures or claiming new live results. Three regression cases cover a forged-MAC 403, other/missing statuses, and unsigned peer metadata relabelling versus original pin mismatch. All 84 harness tests pass locally; the pinned historical fixture verifies with the added scope label; diff checks pass. Please integrate or make the equivalent bounded correction in this PR. My requested change remains pending until it is on an upstream head that can be reviewed.

[altrudev]

@dinakarjs I integrated the bounded correction from your supplemental PR dinakarjs#5 into this PR head 4acb15da36747c12dfe6285e10c53c115f1e7ab9 (five files, including three regression controls). The exact-envelope replay row now reports status-only 403 with response_authentication=not-verified; the offline verifier explicitly identifies peer channel binding as metadata-only-not-signed, and documentation preserves both limitations. No new live or independent-custody claim is made. CI is running for this exact head. Please re-review this updated head for your outstanding evidence-reporting request after the checks settle. Issue #199's independent live, revocation, composed confidential workflow, hardware and maintainer gates remain open.

[altrudev]

@dinakarjs Requesting re-review of the precise corrected head 4acb15da36747c12dfe6285e10c53c115f1e7ab9. I reproduced 84/84 committed tests on both Prometheus and the VPS, and reran the 11/11 real two-host software matrix on this head. The exact-envelope replay observation now explicitly states observed-status-403, response_authentication=not-verified instead of claiming an authenticated peer denial. The offline packet explicitly labels peer_public_key as unsigned metadata; the existing signed TRACE/manifest checks remain pinned independently. These changes address your two requested evidence corrections without overstating custody. Latest upstream CodeQL, Ruff, and validation checks pass. Could you verify these corrections and update the CHANGES_REQUESTED review if satisfied? All remaining independent organizational custody, live third-party peer operation, revocation-feed, confidential workload and hardware gates remain open, and I am not claiming full #199 acceptance.

[dinakarjs]

Re-reviewed the evidence-reporting correction at 4acb15d. Both findings from my changes-requested review are addressed: the exact-envelope replay row reports observed-status-403 with response_authentication=not-verified; offline results report peer_channel_binding=metadata-only-not-signed, with the unsigned-attribution limitation documented. All three regression controls are incorporated. I contributed this bounded correction via dinakarjs#5; this is verification of its integration, not an independent maintainer approval of my contribution.

Exact-head local validation on Linux/Python 3.12.14, using the hash-locked released dependencies: all 84 committed harness tests pass; repository Ruff selection (E4,E7,E9,F, target py39) and diff checks pass. The documented packet CLI succeeds, explicitly retains the historical/software-only/unsigned-peer limits, and reproduces packet SHA-256 402a8f0cc05bc517d2918e7a49b10051cb60122fcac8909f1a9ed308c12fdc13 and record hash sha256:f830659f2af40ff74a42b48e04b1a6c544c41f25e9863c18aae56adc70ff77a5.

All completed hosted technical checks pass at this head. The failed gate is specifically awaiting one independent current-head maintainer approval (zero found), as confirmed from its job log; it is not a failing harness test. My evidence-reporting change request is resolved on this head, with no remaining blocker in that bounded correction. No live-host rerun, external custody, hardware or full #199 acceptance is asserted; those gates remain open.

[dinakarjs]

The re-review at 4acb15d is recorded here: #330 (review) . My evidence-reporting findings are resolved; all 84 tests, packet verification and Ruff pass. I attempted to withdraw only my now-resolved CHANGES_REQUESTED review, but GitHub returned 'Resource not accessible by integration' for dismissPullRequestReview. An authorized maintainer needs to dismiss review 5550255440 as addressed, with this exact-head verification as the reason, then independently assess the PR. This permission limitation does not change the technical result or supply the separate maintainer approval required by the gate.

[noah-ing]

Reviewed 4acb15da36747c12dfe6285e10c53c115f1e7ab9. Requesting changes pending private assessment and resolution of two bounded evidence-validation findings, separate from the corrections already verified above. I have prepared a private write-up but have not yet delivered it through the repository's security reporting channel; detailed reproductions are withheld here in accordance with SECURITY.md.

All 84 committed harness tests passed on macOS and isolated Linux. Additional adversarial controls were local, with simulated dispatch; I did not contact the operator's live hosts or establish full #199 acceptance. These findings do not demonstrate a cA2A authorization bypass or signature forgery.

[dinakarjs]

@imran-siddique maintainer handoff for review-state cleanup: my old CHANGES_REQUESTED review at e3e3eca (review 5550255440) covers the evidence-reporting/unsigned-peer-attribution corrections verified at 4acb15d. I attempted to dismiss only that resolved review, but the connector returned FORBIDDEN/Resource not accessible by integration. Please dismiss that outdated review if appropriate, preserving my current-head technical COMMENT and Noah's separate current-head CHANGES_REQUESTED/private-assessment findings. This is not an approval or a request to merge; those later findings and full #199 acceptance remain unresolved.

Dismissed at dinakarjs's request: both findings were verified fixed at 4acb15d in review 5550731237.

[dinakarjs]

@carloshvp maintainer disposition/private-assessment handoff: Val's withdrawal is recorded in agentrust-io/.github#60, comment 6222894268. Please coordinate ownership of this unchanged 4acb15da36747c12dfe6285e10c53c115f1e7ab9 PR rather than relying on continued author availability.

My earlier evidence-reporting findings are addressed, as documented in review 5550731237; dismissal of only the obsolete review 5550255440 remains an authorized-maintainer action. Preserve Noah's separate current-head changes request (review 5554462951). That review says its private write-up had not yet been delivered; please coordinate a private reporting/fix destination with the reviewer and a named maintainer owner before further adoption. No private reproduction details are requested in this public thread. I can help validate a privately coordinated correction, but this handoff is not approval, evidence of report delivery, or full #199 acceptance.

[imran-siddique]

Val has stepped away from the project (.github#60), so this needs a new owner. @dinakarjs would you take it over? Please open a new PR from a branch that keeps Val's 17 commits as they are and puts your changes on top. #199 is the issue it closes.

@noah-ing thanks, I see your write-up is already filed as GHSA-6m43-h6pm-8fvg. @dinakarjs I have added you to it, and it has a private fork for the fix. This PR stays open until the successor exists.

[dinakarjs]

@imran-siddique yes, I can take over the bounded successor work. I will preserve Val's 17 commits unchanged, retain attribution, and put my signed corrections on top. I note your updated confirmation that the private report is filed and a private fix fork exists; security details and the fix will stay in that coordinated private workflow until cleared for publication.

As I will be contributing implementation, another reviewer must independently assess my changes. My earlier offline verification does not establish independent live custody or full #199 acceptance; those evidence and maintainer gates remain explicit in the successor.