diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 6962540..9b8e6cb 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -56,7 +56,7 @@ jobs: # measurement/REPORT.md is in the nav as Self-verification. if [ -d measurement ]; then cp -r measurement $BUILD/measurement; fi - for fname in README.md CHANGELOG.md CONTRIBUTING.md PRIVACY.md CNAME; do + for fname in index.md CHANGELOG.md CONTRIBUTING.md CODE_OF_CONDUCT.md PRIVACY.md CNAME; do if [ -f "$fname" ]; then cp "$fname" "$BUILD/$fname"; fi done diff --git a/README.md b/README.md index 4c0fbe9..0c6d899 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ [](https://github.com/agentrust-io/trace-spec) []() [](https://github.com/agentrust-io/trace-tests/actions/workflows/ci.yml) -[](https://discord.gg/9JWNpH7E) +[](https://discord.gg/grgzFEHgkj) > **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec). diff --git a/index.md b/index.md new file mode 100644 index 0000000..5e9ad23 --- /dev/null +++ b/index.md @@ -0,0 +1,83 @@ +--- +title: Verify your TRACE implementation +description: Run this suite against your implementation to find out which TRACE conformance level it actually reaches, and produce a report you can hand to an auditor, a counterparty, or an acquirer. +--- + +# TRACE Test Suite + +Conformance tests for [TRACE](https://trace.agentrust-io.com) (Trust, Runtime Attestation, and Compliance Evidence). Run this suite against your implementation to verify it meets the specification before claiming TRACE compliance. + +**Seven modules cover the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply-chain provenance.** + +!!! tip "TL;DR" + - `verify` answers a question for the person running it. `report` produces an artifact for somebody who was not there. + - `report` runs every level up to `--max-level`, because the useful answer is the highest level a record reaches, not whether it cleared the level someone happened to pick. + - The HTML report is self-contained: no scripts, no fonts, no external CSS, no badge service, nothing fetched when it is opened. + - The report is not evidence, and it says so on its face. It carries the record digest, the suite and library versions, and the command to reproduce the result. + +```bash +pip install agentrust-trace-tests +trace-tests verify --record path/to/trust-record.jwt --level 1 +``` + +## A report you can hand to someone else + +```bash +trace-tests report --record trust-record.json --html report.html --json report.json --badge trace.svg +``` + +Use `--fail-under 1` to gate CI on a level. Without it the command always exits `0`, which is what you want when you are producing an artifact rather than enforcing a threshold. `report.json` is stable under `schema: agentrust-io/trace-tests/report/1` for dashboards and CI. + +A conformance report that looks authoritative and cannot be checked is the same shape of thing as a control plane writing its own log. So the report tells a reader who does not trust the sender to go and check the record instead, and gives them what they need to do it. + +## Where to start + +