Skip to content

docs: clarify action receipt verification boundary - #92

Merged
imran-siddique merged 1 commit into
agentrust-io:mainfrom
carloshvp:action-receipts-verification-boundary
Jul 7, 2026
Merged

docs: clarify action receipt verification boundary#92
imran-siddique merged 1 commit into
agentrust-io:mainfrom
carloshvp:action-receipts-verification-boundary

Conversation

@carloshvp

Copy link
Copy Markdown
Member

Summary

Refs #66.

  • clarifies the action-receipt verification boundary for embodied workflows in the spec
  • adds verification-guide taxonomy for accepted receipts, valid rejections, missing required receipts, and invalid receipts
  • adds informative action-receipt fixture shapes without changing the TRACE schema

Validation

  • .venv/bin/ruff check src tests
  • .venv/bin/mypy src/agentrust_trace
  • .venv/bin/pytest --cov=agentrust_trace --cov-report=term-missing
  • git diff --check

Docs build note:

  • .venv/bin/mkdocs build --strict --site-dir /tmp/trace-action-receipts-site-check currently fails before rendering changed pages because the existing MkDocs config uses docs_dir: ., which MkDocs rejects as the parent directory of the config file.

Signed-off-by: Carlos Hernandez-Vaquero <carloshvp@gmail.com>

@imran-siddique imran-siddique left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving. The new §3.3.2 (informative) and the verification-guide additions are accurate and well-scoped.

  • Purely informative and additive: no change to schema/trace-claim.json, and the new examples/action-receipts/ fixtures are explicitly marked as non-Trust-Records not validated by the schema (examples/README.md + examples/action-receipts/README.md), so additionalProperties: false is not at risk.
  • The verification boundary is stated correctly and consistently with the existing §3.3.1 trust-boundary paragraph: a signed controller rejection is valid negative evidence, not a TRACE verification failure, while a signed acceptance does not prove physical completion or functional-safety certification unless a stricter profile defines and trusts that external claim. The four outcomes (receipt_valid_accepted / receipt_valid_rejected / receipt_missing_required / receipt_invalid) are coherent and match between spec, verification.md, and the fixture README.
  • Correctly keeps the action-receipt requirement axis independent of build-provenance depth, and the verifier steps (recompute digest, trusted issuer key not the embedded key, chain ordering, session/call binding, report missing/stale separately) mirror the §3.3.1 rules.

CI green. LGTM.

@imran-siddique
imran-siddique merged commit 4f145e6 into agentrust-io:main Jul 7, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants