v0.12.0

This release carries 10 conformance corpora and 736 members, and every count in the table is recomputable by anyone who clones the v0.12.0 tag.

What is in this release

Corpus	Suite	Members
vectors/	adversarial-execution-evidence-conformance	272
vectors-w3c-report/	w3c-report-v01-conformance	222
vectors-ai-agent-action/	ai-agent-action-conformance	53
vectors-observed-effect/	observed-effect-conformance	49
vectors-acs-core/	acs-core-negative-conformance	32
vectors-anchor-stream/	anchor-stream-conformance	32
vectors-scitt-cose/	scitt-cose-carriage-conformance	27
vectors-aci/	aci	26
vectors-mcp-record-contract/	cross-run-record-contract	15
vectors-artifact-binding/	artifact-binding-conformance	8

Every number in the table is the length of that corpus's manifest vector list, counted from the tagged tree, and none of them was copied out of a document.

New in 0.12.0

The Observed Effect predicate ships its corpus, its two reference rails, and its published type URI, which resolves:

https://probityai.github.io/agent-evidence-vectors/predicate/v1/observed-effect

A type URI that answers nothing leaves a verifier unable to separate a type that was never published from one that was withdrawn. The site that answers for it ships in this release.

The Go module path moved, so this is a minor version, and because every tag declares its own path forever an install pinned to an earlier tag still names the former owner. An install under the old path fails. This is the first release whose install line resolves under the current path:

go install github.com/probityai/agent-evidence-vectors/cmd/aee-verify@v0.12.0

Verifying this release without trusting us

release/CORPUS-DIGESTS.txt lists one line per corpus. It is signed with the corpus key, its signature carries an RFC 3161 timestamp token from a third-party authority, an OpenTimestamps proof is beside it, and every digest the file lists can be recomputed from the tagged tree. Verify the signature against the public half anyone can fetch:

cosign verify-blob --key release/cosign.pub \
  --signature release/CORPUS-DIGESTS.txt.sig release/CORPUS-DIGESTS.txt

Then recompute the digests and compare:

python3 scripts/release-digests.py --check

Installing from PyPI

The wheel and the source distribution both build, install from outside a checkout, and replay every corpus in the table above. The release workflow ran all three before it uploaded anything:

uvx agent-evidence-vectors

Each file on PyPI carries an attestation naming this repository and the release workflow that built it, so a reader who downloads either one can check where it came from.

v0.11.1

The corpus is unchanged. Every digest in release/CORPUS-DIGESTS.txt is identical to the one v0.10.1 published, so no vector moved and no consumer rail has to re-vendor against v0.11.1. Each is recomputed from the vector files on disk, never copied out of a manifest. The eight corpus manifests still sum to 461 vectors, running from 272 in the adversarial-execution-evidence corpus at suiteRevision 28 down to 8 in the artifact-binding corpus.

The suite now installs from PyPI as a wheel, so a relying party replays a corpus against their own verifier with nothing cloned and no dependency to resolve:

uvx agent-evidence-vectors --verifier './your-verifier --json'

The same harness runs as a single step inside a consumer's own workflow, pinned to whichever release the step names:

- uses: astrogilda/agent-evidence-vectors@v0.11.1
  with:
    verifier: ./your-verifier --json

That wheel declares no dependencies at all and carries every one of the eight corpora as package data, so the replay itself reaches no network once the package is on disk. The release workflow builds from the verified tag, rejects any wheel whose version is not the tag's, runs that wheel from a temporary directory outside the build tree and asserts a report with no failures and no suite refusals, and only then uploads through a PyPI trusted publisher.

v0.11.0 carries the same corpus and never reached PyPI. Its uploader was pinned to a Twine older than core metadata 2.5, which the build backend emits, so it rejected the wheel after the trusted-publisher exchange had already succeeded. Cite v0.11.1.

You can check it without trusting this page:

python3 scripts/release-digests.py --check
uv run python scripts/release-gate.py --tag v0.11.1

The second command is this repository's own verifier: it recomputes every digest from the vector files on disk, checks the digest file's detached signature against the published half of the signing key that a stranger would use, and refuses a release surface carrying uncommitted changes. It reaches no transparency log.

v0.10.1

agent-evidence-vectors is the new name. aee-conformance named one predicate and the repository now carries eight corpora, so GitHub redirects the old path at the web, the API and the git endpoint and existing clones keep working.

The Go module path moved with it in the same commit, to github.com/astrogilda/agent-evidence-vectors, with no replace directive or alias, and the four versions cached under the old path still resolve.

What the suite contains

At v0.10.1 the eight corpus manifests sum to 461 vectors. I recompute every digest below from the vector files with scripts/release-digests.py, which refuses any corpus it cannot recompute.

corpus	suite	vectors
vectors	adversarial-execution-evidence-conformance	272 at suiteRevision 28
vectors-ai-agent-action	ai-agent-action-conformance	53
vectors-anchor-stream	anchor-stream-conformance	32
vectors-acs-core	acs-core-negative-conformance	28
vectors-scitt-cose	scitt-cose-carriage-conformance	27
vectors-aci	aci	26
vectors-mcp-record-contract	cross-run-record-contract	15
vectors-artifact-binding	artifact-binding-conformance	8

One binary judges all of them

aee-verify <corpus-directory> picks its reader from the suite each manifest declares, so one command covers every corpus, and the five per-corpus Python runners are deleted because the Go readers replacing them recompute every member identifier from its own bytes. A corpus whose reader is unwritten exits 2, and nothing here treats that exit as a pass.

Checkable without trusting this page

python3 scripts/release-digests.py --check

cosign verify-blob --key release/cosign.pub \
  --signature release/CORPUS-DIGESTS.txt.sig \
  --insecure-ignore-tlog=true release/CORPUS-DIGESTS.txt

openssl ts -verify -in release/CORPUS-DIGESTS.txt.sig.tsr \
  -digest "$(base64 -d release/CORPUS-DIGESTS.txt.sig | sha256sum | cut -d' ' -f1)" \
  -CAfile spec/tsa-roots.pem

ots verify -d "$(base64 -d release/CORPUS-DIGESTS.txt.sig | sha256sum | cut -d' ' -f1)" \
  release/CORPUS-DIGESTS.txt.sig.ots

I ran all four from a fresh clone at v0.10.1 before publication. The first needs nothing installed. The fourth reaches its calendar attestations and wants a Bitcoin node.

Cite v0.10.1. At v0.10.0 the first command fails in a fresh clone with ModuleNotFoundError: No module named 'cbor2', because the routine for one corpus's digest sat in a generator importing a COSE library at module scope, and a test now runs it in a subprocess that cannot see any installed package.

The ci workflow on this commit failed on two test-harness defects, a temporary-directory cleanup race in the spec-anchor gate and an unused parameter in the Go corpus reader, neither of which touches a vector, a manifest or a signed digest; both are fixed on main at 7aaf147, where every workflow is green.

corpusDigest moves for every vector: its preimage commits to each vector's path, and every path changed. Every consumer rail must re-vendor.

Edited 2026-09-12 to cite the manifests.

aee-conformance v0.8.0

aee-conformance v0.8.0

First release carrying the vectors-ai-agent-action suite. The earlier tags
v0.6.0, v0.7.0 and cited/5019931 hold the adversarial-execution-evidence
corpus only; this suite did not exist when they were cut.

vectors-ai-agent-action, the conformance corpus for the AI Agent Action
predicate proposed in in-toto/attestation#588:

53 vectors, 37 accept and 16 reject, across 16 conditions.
corpusDigest f2be44dbb8d207a444eecc19874b7ba3e1276f15175c7f161e8062909ddc1d2a
specDigest 273eb3475d11610b5f868661abb7b5538546c482a1a7d589a07a635ef2a79c02
spec-vendored regenerated against in-toto/attestation#588 at
8783c6b800247f2ffe34714a32a9b722e438d851.

Every reject vector has an accepting twin carrying the same condition id, and
check_vectors.py refuses a corpus where one does not, so a verifier that
rejects everything does not satisfy this corpus. Regenerate with
gen_vectors.py and self-check with check_vectors.py; both are stdlib only.

This suite versions itself by corpusDigest and carries no suiteRevision. That
field belongs to the vectors corpus and the two are unrelated.

vectors, the adversarial-execution-evidence corpus, unchanged in this release:

272 vectors, 61 accept, 209 reject, 2 indeterminate, at suiteRevision 27.
corpusDigest 9511932915617bfcbd7bafdb4cf6e6b050fec69225ed6fb2883984c0b098008a

Verify a suite's identity by running its own self-check at the tag rather than
by counting files.