Issues

• prototype(tdx_collateral): reject non-finite JSON, non-minimal/duplicate PCK OIDs, boolean integer fields, and non-list advisoryIDs

  needs-review:MEDIUM
  agentrust-io/trace-spec#644 · Filter by author drk-ram opened on Oct 30, 2026
  1

• prototype(snp_collateral): verify VCEK signature against ASK and enforce canonical HCL base64, report version, and component bounds

  needs-review:MEDIUM
  agentrust-io/trace-spec#646 · Filter by author drk-ram opened on Oct 30, 2026
  1

• fix(delegation): reject private JWKs in trusted_root_keys, duplicate lattice entries, and invalid credential bounds

  needs-review:MEDIUM
  agentrust-io/trace-spec#647 · Filter by author drk-ram opened on Oct 30, 2026
  1

• conformance(loader,report): reject non-standard JSON constants in loads_strict and validate record_digest/build inputs

  needs-review:MEDIUM
  agentrust-io/trace-spec#648 · Filter by author drk-ram opened on Oct 30, 2026
  1

• prototype(gate_store): reject float overflow, out-of-range integers, empty identifiers, and invalid RemoteGateStore timeout

  needs-review:MEDIUM
  agentrust-io/trace-spec#645 · Filter by author drk-ram opened on Oct 30, 2026
  1

• [maintainer-interest] Reviewer / Maintainer interest — Raghuvar Durga (@drk-ram)

  needs-review:MEDIUM
  agentrust-io/trace-spec#640 · Filter by author drk-ram opened on Oct 27, 2026
  1

• fix(platform_measurement): reject non-string or empty runtime.measurement across Python and TypeScript

  needs-review:MEDIUM
  agentrust-io/trace-spec#628 · Filter by author drk-ram opened on Oct 25, 2026
  1

• fix(provenance,validate): remove str() coercion on digest/hash fields in provenance and enforce strict JSON in schema loaders

  needs-review:MEDIUM
  agentrust-io/trace-spec#627 · Filter by author drk-ram opened on Oct 25, 2026
  1

• conformance(inclusion): enforce registry-anchor-v1 surrogate/key/cycle rules and validate leaf_index/entry fields

  needs-review:MEDIUM
  agentrust-io/trace-spec#625 · Filter by author drk-ram opened on Oct 25, 2026
  1

• content_marking: validate record.alg against record.hash prefix, reject unknown assertion fields, and check anchor agreement

  needs-review:MEDIUM
  agentrust-io/trace-spec#614 · Filter by author drk-ram opened on Oct 23, 2026
  1

• intent_bridge,successor_observation: validate caller options and trusted JWKs at entry and deep-copy observation before predicate

  needs-review:MEDIUM
  agentrust-io/trace-spec#617 · Filter by author drk-ram opened on Oct 23, 2026
  1

• trust-record-verify: reject non-object inputs in parentRecordHash, verifyDelegationLink, and bundleDigest

  needs-review:MEDIUM
  agentrust-io/trace-spec#616 · Filter by author drk-ram opened on Oct 23, 2026
  1

• prototype(azure_execution_binding): bind HCLAkPub exponent e and key size, reject duplicate JSON keys, and harden _secure_boot_state and authenticode_sha256

  needs-review:MEDIUM
  agentrust-io/trace-spec#613 · Filter by author drk-ram opened on Oct 23, 2026
  1

• Spec change proposal: resolve TRACE v0.2 verifier contradictions from #591

  agentrust-io/trace-spec#593 · Filter by author noah-ing opened on Oct 20, 2026
  1

• Implementation report: six verifiers written from the v0.2 text alone, run over 2,816 inputs (four findings)

  bugneeds-review:HIGH
  agentrust-io/trace-spec#591 · Filter by author ogasurfproject-jpg opened on Oct 19, 2026
  11

• docs/spec: close Go verifier findings on Anchor Format §1 escaping rules, verifier-compatibility README, and Acta crosswalk (#448 items 3, 16, 19)

  agentrust-io/trace-spec#536 · Filter by author drk-ram opened on Oct 15, 2026
  1

• v0.3: let a record name the agent manifest it ran under

  agentrust-io/trace-spec#483 · Filter by author imran-siddique opened on Oct 8, 2026
  6

  

• TR-ANC-002 can earn Level 2 without binding receipt root/count to the transparency-named entry

  agentrust-io/trace-spec#464 · Filter by author imran-siddique opened on Oct 2, 2026
  3

  

• Implementation findings from the Go verifier (#444): 26 items

  agentrust-io/trace-spec#448 · Filter by author imran-siddique opened on Oct 1, 2026
  3

  

• Implementation report: a Go verifier for v0.2, written from the spec (26 findings)

  agentrust-io/trace-spec#444 · Filter by author carrollco opened on Sep 30, 2026
  2

• MCP server components and a server-to-catalog relationship method

  agentrust-io/trace-spec#443 · Filter by author imran-siddique opened on Sep 30, 2026
  9

  

• Delegated appraisers: chains and revocation before valid_until

  agentrust-io/trace-spec#442 · Filter by author imran-siddique opened on Sep 30, 2026
  1

  

• Evidence resolution: fetch and re-appraise what an evidence reference points to

  agentrust-io/trace-spec#441 · Filter by author imran-siddique opened on Sep 30, 2026
  1

  

• Gateway replay state needs a replicated store, not one store server

  agentrust-io/trace-spec#440 · Filter by author imran-siddique opened on Sep 30, 2026
  1

  

• spec: silent mode MUST NOT block a policy deny (breaking, 30-day comment)

  agentrust-io/trace-spec#421 · Filter by author imran-siddique opened on Sep 26, 2026