From bd0da5b5b4f87ea1fb5f823c52feb3ad83218f32 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Fri, 4 Sep 2026 12:02:10 -0700 Subject: [PATCH] feat(registry): give the TRACE Registry a page on agentrust-io.com The registry has only ever had a raw GitHub URL to hand out, which is a poor answer when the ask is a link an audience can act on. This adds /registry/ on the apex site, built on the same pattern as /wcm/. Every figure on the page is checkable from the public repository and was counted on main at 4697f2c: two published entries, one signed checkpoint, trace-verify 0.3.1 on PyPI, 225 tests. The checkpoint block is copied verbatim from registry/2026/09/01.ndjson rather than illustrated. The limits section states the four that matter: the chain proves consistency of what it covers rather than coverage of the registry, the June 2026 entry is deliberately not folded in retroactively, no external witness receipt has come back and verified offline yet, and the first anchored record's producer key is single-use by construction. Also registers the page in sitemap.xml, supernav.js, and llms.txt. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01CJQz3ToBJPj97WUNStAwSQ --- llms.txt | 3 + registry/index.html | 255 ++++++++++++++++++++++++++++++++++++++++++++ sitemap.xml | 6 ++ supernav.js | 2 + 4 files changed, 266 insertions(+) create mode 100644 registry/index.html diff --git a/llms.txt b/llms.txt index 6e0d89a..8ccf676 100644 --- a/llms.txt +++ b/llms.txt @@ -33,6 +33,9 @@ OPAQUE Systems is a founding engineering and infrastructure sponsor of AgenTrust - [Agent Manifest](https://manifest.agentrust-io.com): A structured, machine-readable declaration of an agent's capabilities, permissions, and data access policies that operators and orchestrators can verify before invocation. - [Confidential MCP (cMCP)](https://cmcp.agentrust-io.com): The secure, confidential way to run MCP. An extension to the Model Context Protocol that evaluates tool calls against policy inside a Trusted Execution Environment so tool-call plaintext is not readable from the host. The guarantee is bounded: it holds where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference. - [Confidential A2A (cA2A)](https://ca2a.agentrust-io.com): The secure, confidential profile for A2A. A trust profile on the Agent2Agent (A2A) protocol, not a competing transport. Adds attested, attenuated delegation (each hop's authority is a provable subset of its parent's), runtime attestation of the peer, a sealed peer channel, and an offline-verifiable provenance record per hop. Developer preview. +- [TRACE Registry](https://agentrust-io.com/registry/): A public, append-only registry of anchors for signed TRACE trust records, with signed Merkle Mountain Range checkpoints committing to the log's own history. Published as files in an open repository and verified offline with the `trace-verify` package from a raw Ed25519 public key, so no verification endpoint has to be trusted. Registration attests to inclusion and time, never to the truth of a record's claims. Two published entries and one signed checkpoint as of September 4, 2026; external witnessing of the registry's own history is in progress and not yet claimed. +- [Source](https://github.com/agentrust-io/trace-registry): Registry entries, checkpoint and anchor tooling, chain verifier, limitations, terms of use, and governance. + - [AgenTrust Agentic Controls](https://agentrust-io.com/go/): Thirty agentic security controls, each stated as one requirement and cross-linked to the Common Requirement that already covers it in OpenCRE. Every control carries a stable permalink at `/go//` so an external standard can cite it without the link rotting. It is a mapping, not a conformance claim. ## Get started diff --git a/registry/index.html b/registry/index.html new file mode 100644 index 0000000..3dc5368 --- /dev/null +++ b/registry/index.html @@ -0,0 +1,255 @@ + + + + + +TRACE Registry | AgenTrust + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ agentrust.io + +
+ +
+ Append-only · Signed checkpoints · Offline verification +

A public record of agent evidence,
built to be distrusted

+

The TRACE Registry publishes anchors for signed trust records, and commits to its own history with append-only checkpoints. Every entry, every checkpoint, and every number on this page verifies on your machine from published bytes and a raw public key. There is no account to create, no API key to hold, and no operator you have to believe.

+
+ Verify a checkpoint yourself + Read what it does not prove +
+
Public repository · trace-verify 0.3.1 on PyPI · Checkpoint chain live since September 1, 2026
+
+ +
+ +
+
+ 2Published entries + 1Signed checkpoint + 0.3.1Verifier on PyPI + 225Tests passing +
+

Counted on main at commit 4697f2c. Two entries and one checkpoint is the true size of this log today, and we would rather publish the real number than a flattering one. Clone the repository and run python -m pytest to check the test count for yourself.

+
+ +
+ The design problem +

A registry's job is to be believed by strangers

+

Signatures prove that records are authentic. They do not prove that everyone is being shown the same set of records. A log operator who can quietly serve one history to an auditor and another to everyone else has defeated the point, and no amount of signing catches it.

+

So "trust our database" fails in exactly the situations a registry exists for: disputes, audits, and adversaries. The requirements that fall out of that are narrow and testable. The log must be append-only with cheap proofs. It must verify offline. Nothing sensitive should leave the producer by default. And its integrity should eventually be anchored somewhere the operator does not control.

+
+ +
+ The live record +

Checkpoint 1, as published

+

This is the first signed checkpoint of the log, taken verbatim from registry/2026/09/01.ndjson. The key_id is the raw 32-byte Ed25519 public key in hex. A verifier needs nothing else from us to check the signature.

+
+
registry/2026/09/01.ndjson · mmr_checkpoint
+
+
log_id trace-registry/v1
+
key_id bc133259c094f63694b4ec48a295d7501a9a0cd536df5631fb4663c155f7bc90
+
mmr_size 1
+
root 3af8ddf2c1f429bb4fc670437e48640887f60de809b18f8ccea55fefb0c6639a
+
prev_size 0
+
timestamp 2026-09-01T21:39:37Z
+
verify signature checks OFFLINE from key_id alone
+
+
+

Checkpoints carry commitments, never claim content. A checkpoint is a few hundred bytes describing the shape of the log: its size, its root, and the size and root of the checkpoint before it. Trust-record payloads stay with whoever produced them.

+
+ +
+ How it works +

Four moving parts, none of which require trusting the operator

+
+ +
+
1
+
+

A producer signs a trust record

+

The record is signed where it is produced, under the producer's own key. The registry never sees a private key and does not sign on anyone's behalf.

+
+
+ +
+
2
+
+

Only a digest is anchored

+

What lands in the registry is an anchor leaf derived from the exact signed bytes under Anchor Format v1, not the record. Recomputing the leaf from a changed record produces a different value and stops matching.

+
+
+ +
+
3
+
+

The log appends, and never rewrites

+

Entries accumulate in an append-only Merkle Mountain Range. Appending never rebalances the structure, so proofs issued earlier stay valid, and inclusion and consistency proofs stay cheap as the log grows.

+
+
+ +
+
4
+
+

A signed checkpoint commits to the history

+

The scheduled anchor pipeline emits a signed checkpoint carrying the log's size and root plus the previous checkpoint's size and root. That chained pair is what lets a third party check that each checkpoint extends the last rather than replaces it.

+
+
+ +
+
+ +
+ Check our work +

The verification runs on your machine, not ours

+

There is no verification endpoint to call, because a verification endpoint you have to trust is not verification. The registry is files in a public repository and the verifier is a package you install.

+ +
+ +
+
1
+
+

Install the verifier

+
+
Terminal
+
python -m pip install trace-verify
+
+
+
+ +
+
2
+
+

Clone the registry

+

The entire published history is in the repository. There is nothing held back on a server.

+
+
Terminal
+
git clone https://github.com/agentrust-io/trace-registry
+cd trace-registry
+
+
+
+ +
+
3
+
+

Verify the checkpoint chain

+

Checks each checkpoint's signature from its own key_id, then checks that each one extends the last and matches the raw entries it claims to cover.

+
+
Terminal
+
python tools/verify_checkpoint_chain.py \
+  registry/2026/06/12.ndjson \
+  registry/2026/09/01.ndjson
+
+
+
+ +
+ + +
+ +
+ Honest scope +

What a registry entry is, and what it is not

+

Registration attests to inclusion and time. It is not an endorsement of content, a certification of the producer, or evidence that any claim inside a record is true. Four specific limits are worth stating here rather than leaving to be discovered.

+ + + + + + + +
LimitWhy it stands
Consistency, not coverageThe checkpoint chain proves the consistency of what it covers. It does not prove that the registry covers everything it could have. Completeness is a property of producers keeping their own records, not something a log can assert about itself.
The June 2026 entry is outside the chainIt predates checkpointing and is deliberately not folded in retroactively, which is the same rule the chain verifier applies. Backdating an entry into a chain would make the chain say more than it checked.
No external witness receipt yetAnchoring the registry's own history into a transparency service the registry does not operate is in progress in public, and no receipt has come back and verified offline yet. Until one has, the anti-split-view property is a roadmap item, not a feature.
One producer key is single-use by constructionThe producer key behind the first anchored record verifies that record and will never sign another, because the demo that produced it generates keys per run and never persists private ones. That is a property of that entry, not a general guarantee.
+ +

A witness attesting to more than it checked is worse than no witness. That principle is why the limits above are on this page instead of in a footnote, why the entry counts here are the real ones, and why an external receipt will be announced when it verifies rather than when it is arranged.

+ +

Full limitations ↗Terms of use ↗Governance ↗Roadmap ↗

+
+ +
+ Take part +

Three ways in

+
+

Register as a producer

Publish anchors for your own signed trust records under your own key. The conventions, naming, and submission path are documented in the repository.

Read the contributor guide →
+

Run a mirror or a witness

Single-operator dependency is a weakness we name rather than hide. Independent mirrors and independent witnesses both remove it, and both are open to anyone.

Mirroring guide →
+

Attack the claims

The most useful contribution is a demonstration that something on this page overstates what the code actually does. Open an issue in public.

Open an issue →
+
+
+ +
+ +
+
+
+ AgenTrust +
Open standards for AI agent governance
+
+
+ Home + Quickstart + Demos + GitHub +
+
Independent open-source project. OPAQUE Systems provides funding, engineering time, infrastructure, and confidential-computing contributions as a founding sponsor. Sponsorship does not confer ownership or governance authority.
+
+
© 2026 AgenTrust Contributors · agentrust-io.com
+
+ + + + + diff --git a/sitemap.xml b/sitemap.xml index 3ad59c4..d433a0e 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -30,6 +30,12 @@ monthly 0.9 + + https://agentrust-io.com/registry/ + 2026-09-04 + weekly + 0.9 + https://agentrust-io.com/wcm/ 2026-08-23 diff --git a/supernav.js b/supernav.js index 58c7164..76e4a81 100644 --- a/supernav.js +++ b/supernav.js @@ -13,6 +13,7 @@ { id: 'quickstart', label: 'Quickstart', url: 'https://agentrust-io.com/quickstart/', ext: false }, { id: 'demos', label: 'Demos', url: 'https://agentrust-io.com/demos/', ext: false }, { id: 'telemetry', label: 'Telemetry', url: 'https://agentrust-io.com/telemetry/', ext: false }, + { id: 'registry', label: 'Registry', url: 'https://agentrust-io.com/registry/', ext: false }, { id: 'trace', label: 'TRACE', url: 'https://trace.agentrust-io.com', ext: false }, { id: 'manifest', label: 'Manifest', url: 'https://manifest.agentrust-io.com', ext: false }, { id: 'cmcp', label: 'cMCP', url: 'https://cmcp.agentrust-io.com', ext: false }, @@ -30,6 +31,7 @@ var CURRENT_ID = (HOST === 'agentrust-io.com' && PATH.indexOf('/quickstart') === 0) ? 'quickstart' : (HOST === 'agentrust-io.com' && PATH.indexOf('/demos') === 0) ? 'demos' : (HOST === 'agentrust-io.com' && PATH.indexOf('/telemetry') === 0) ? 'telemetry' + : (HOST === 'agentrust-io.com' && PATH.indexOf('/registry') === 0) ? 'registry' : (HOST === 'agentrust-io.com' && PATH.indexOf('/extensions/ca2a') === 0) ? 'ca2a' : HOST === 'agentrust-io.com' ? 'home' : HOST.indexOf('trace.') === 0 ? 'trace'