Add Litzki Systems SOVP → TRACE integration

[litzki-systems]

Manifest-only integration for SOVP (Sovereign Validation Protocol).

SOVP produces TRACE-conformant attestation records (Level 0, Ed25519-signed, JCS-canonicalized) from its domain verification pipeline.

Repro steps:

• trace-tests verify --record … --level 0 → PASS 8/8
• Signed form re-verifiable via agentrust_trace.verify_record
• CI in source repo runs continuously: https://github.com/litzki-systems/sovp-agentrust-bridge

Requesting Verified tier review.

[imran-siddique]

I ran the Verified-tier check rather than only the structure check, because CONTRIBUTING.md promises "we run it end-to-end" when it is requested, and your reproduction steps were complete enough to actually follow.

Throwaway venv, released packages only, no editable install of anything of ours: agentrust-trace 0.9.0, agentrust-trace-tests 0.5.1, agent-manifest 0.11.1, cmcp-runtime 0.4.0. Ed25519 key generated locally, record generated from your committed example through litzki-sovp-trace, then verified:

7 passed                                        (integrations/litzki-sovp/tests)
Result: PASS  (8 checks, 0 skipped)             trace-tests verify --level 0

Your "PASS 8/8" is exact, down to the skip count.

The claim in your description is the one I checked hardest, and it holds. "Signing only the fields the caller supplies and inferring no claims" is falsifiable, which is the standard the Community tier applies to descriptions, so I diffed the output record against the input. appraisal.status is "none", build_provenance.slsa_level is 0, and runtime.platform is "software-only" even though your input carries a tee_measurement you could have leaned on to claim a hardware root. Every value in the record not traceable to the input is a structural constant: the profile URI, the curve name, the verifier name, the origin kind. None of them is a claim.

That last one is worth naming explicitly. A bridge that saw tee_measurement: sha256:... in its input and wrote a TEE platform value would pass conformance and be lying, and it is the most common way this integration could have gone wrong. You carried the measurement through without upgrading what it asserts.

Submitting at tier: community while asking for Verified was also the right read of the rules. Tier is maintainer-set, and self-declaring it is the thing that would have made me look harder at everything else.

One defect, in your repo rather than this diff, and worth fixing before it bites you. integrations/litzki-sovp/pyproject.toml floors three dependencies at zero: agentrust-trace>=0, agentrust-trace-tests>=0, cmcp-runtime>=0. We hit exactly this in demos#48: an unpinned floor turns a resolver conflict into a silent downgrade rather than an error. pip backtracks to an ancient release, exits 0, and the failure surfaces later as a runtime crash that looks like a bug in the dependency. cmcp-runtime 0.1.0 in particular predates most of what your bridge assumes. Your CI got 0.4.0 today because the resolver happened to, not because anything required it. Real floors would make that green run mean something.

Approving and merging. Flipping the tier to Verified in a follow-up, since I have now done the work that tier records.