Repository navigation
Audit and enforce package release safeguards across AgenTrust #54
Description
Activity
Post-merge audit and proposed bounded trace-registry follow-up
Post-merge evidence
trace-spec #467, cMCP #722, trace-registry #113, and integrations #276/#277 have merged. All 32 push-triggered workflow runs returned for their exact merge revisions completed successfully:
PR Merge revision Successful push runs Representative evidence trace-spec #467 03ea1ef97548e93f30ad4ad3d31b374d8bf27d997/7 CI, Conformance CI, workflow lint cMCP #722 5d09f089061b3d510ab1634172a62b80f221f62f6/6 CI, workflow lint trace-registry #113 221af17a345fa9dd9fe546260718977e5c539e934/4 CI, workflow lint integrations #277 e61be77731caf752c618ecfa2d7ee56f7e9a990a8/8 workflow lint, integration validation integrations #276 3b66dce518c93e8c0fc1d6ddce773eabe406c1947/7 integration validation #276 is a marketplace refresh, not a publisher safeguard. Main-branch CI success does not establish an executed publisher rehearsal.
Environment decisions remain separate
Read-only REST environment inspection on October 5 returned no required-reviewer rules, no deployment-ref policy, and
can_admins_bypass: truefor all five inspected publishing environments:- trace-spec environments:
pypi,conformance-pypi - cMCP environments:
pypi - trace-registry environments:
pypi - integrations environments:
pypi
The conformance cutover exception is already documented in this issue. Could maintainers identify primary/backup reviewers and agree intended release-tag restrictions, self-review prevention where supported, and disabled administrator bypass or reviewed exceptions? The shared integrations environment needs both package tag families. A required-reviewer list requires one listed approval, not all listed reviewers.
Proposed trace-registry implementation scope
At merge revision
221af17a345fa9dd9fe546260718977e5c539e93, publish.yml has the new exact ref/tag/package/runtime-version guard, but the publisher has no release-revision test dependency or installed-artifact check. The build job uses thepypienvironment andid-token: writeeven during build-only execution.Release-revision validation
- Run required tests and validation against the exact revision being packaged.
- Make artifact building depend on successful validation; failed, cancelled or skipped validation must prevent publication.
- Handle the existing append-only check explicitly: its push/PR base-SHA assumptions must not silently disable validation or produce invalid comparisons on release/manual events.
Installed-artifact verification
- Build wheel and sdist, then install each into a separate clean environment.
- Run checks outside the repository so imports cannot resolve to the source tree.
- Verify packaged/runtime version agreement, CLI availability and a representative successful verification case.
- Include an invalid-evidence case with its expected rejection, so the installed verifier cannot pass by accepting everything.
Publishing isolation
- Keep build-only as the manual default.
- Move the
pypienvironment and publishing OIDC grant into a separate publishing job. - Require explicit manual publication and the existing exact ref/tag/package/runtime-version agreement.
- Require successful validation, artifact checks and artifact transfer before publication.
Regression evidence
- Cover valid publication eligibility, branch/unrelated-tag/version-mismatch refusal, and build-only behavior.
- Check that weakening the test dependency, tag guard or publishing condition is detected.
- Preserve pinned actions, existing package checks and production-only publishing.
Could you confirm this scope, the required release-validation subset and a review owner before implementation? This is a proposal, not an ownership claim or newly executed fixture evidence. Environment protections, exact registry trusted-publisher bindings and backup-operator availability remain separate #54 work. No settings were changed, publishing workflows dispatched or packages published; this does not complete the organization-wide audit.
- trace-spec environments:
Extended read-only publisher inventory, following the post-merge audit above. These are source observations at pinned revisions, not newly executed release tests or environment-setting verification.
Repository Pinned evidence Remaining gap / decision agent-manifest publish.yml at 055145f Manual dispatch has no build-only mode or publish-job condition. Its tag/version check runs only when the ref already matches python-v*, so a branch dispatch can reach publication. Installed wheel/sdist checks and publishing-job OIDC exist, but there is no release-test dependency or environment binding in the publish job. This matches the earlier local patch scope awaiting confirmation/vouching; I have not opened a PR or claimed the registry binding itself is absent.ca2a release.yml at 9f74318 Exact tag/version and installed wheel/sdist checks exist, with OIDC scoped to the publishing job. There is no prepublication test dependency. Strict AGT verification runs in governance-release, which depends onpublish, so it cannot prevent the PyPI upload if it fails. Please confirm whether that verification is intended as a prepublication gate or postpublication attestation before proposing a move.weight-custody-manifest publish.yml at e573b97, release gate, reusable validation Validation precedes build; source/version and archive scans exist. Manual dispatch publishes to TestPyPI and requires current main, rather than offering build-only rehearsal. That differs from this issue's production-PyPI-only direction. Agree a build-only replacement without dispatching TestPyPI. Reusable validation exercises a separately built installed sdist; it does not install the final distartifacts transferred by this publisher.Telemetry's publisher inventory remains unresolved. It is active/public, but searches for
gh-action-pypi-publishandpublishreturned no hits; that is not proof of absent publishing authority. The initial public REST scan hit a rate limit before collecting the additional repositories' environments, so their live protection settings remain unknown.Suggested prioritization: retain the posted trace-registry scope decision and environment-protection decisions first; confirm agent-manifest scope/vouching, ca2a verification timing, and WCM's build-only transition before further implementation. Exact registry bindings, primary/backup operators, telemetry and broader non-Python publisher coverage still require evidence. No settings were changed, workflows dispatched or packages published.
Telemetry inventory correction: supersedes the unresolved telemetry status in my preceding inventory comment.
A direct Git checkout at
590d6182f6b8ae0938a0546439ed854b92745d64allowed inspection of all nine workflow files. release.yml publishes two packages from a published GitHub release:- PyPI:
agentrust-telemetry, environmentpypi. - npm:
@agentrust-io/telemetry, environmentnpm.
Existing source controls: release-tag/cross-ecosystem version agreement, Python wheel/sdist installed-schema smoke checks, TypeScript build/tests, derived npm prerelease dist-tags, and OIDC scoped to separate publishing jobs. The separate release-assets job also uses OIDC for artifact attestation. No additional package/container publisher was found in those workflow files; this is not a claim about every external/manual publishing authority.
Two bounded validation gaps remain:
- The release workflow does not depend on the full Python 3.10–3.13 CI matrix, including schema/compatibility checks, conformance and unittest execution. RELEASING.md asks for successful CI procedurally; that is not a release-revision workflow dependency.
npm run checkbuilds/tests the source and performs a pack dry-run, then the workflow creates the final tarball. No install/import/test of that final tarball was found before npm publication.
Live
pypi/npmenvironment protections, exact registry trusted-publisher bindings and primary/backup operator availability remain unverified. The release build'starget_commitish == 'main'condition is also a target label, not an independently checked Git ancestry proof; any reviewed-history requirement should be agreed explicitly.Please include the two validation gaps in the maintainer-prioritized backlog alongside the already proposed trace-registry work. This is source inspection, not new release execution or implementation ownership. No release was dispatched, settings changed or package published.
- PyPI:
@dinakarjs rulings on the implementation items, so you can move:
- trace-registry: scope confirmed as written. The validation subset is the existing
ci.ymltest job. On release and manual events, skip the append-only base-SHA check by name rather than letting it no-op. Start here and request my review. - agent-manifest: same shape. Build-only is the manual default, the tag/version check runs unconditionally, and publishing depends on the tests.
- ca2a:
governance-releaseis a post-publication attestation attached to the release, and it stays afterpublish. The gap is the missing test dependency beforebuild, the same fix as trace-spec#467. - weight-custody-manifest: yes, replace the TestPyPI dispatch with a build-only rehearsal.
- agentrust-telemetry: both gaps are in. The release depends on the CI matrix, and the final npm tarball is installed and tested before publication.
One repository per PR, in that order. Environment protections and the reviewer roster are org settings and sit outside this work.
- trace-registry: scope confirmed as written. The validation subset is the existing
Post-merge source audit checkpoint (October 8, 2026; read-only)
This updates, rather than repeats, the earlier publisher inventories in this issue. Following the merges of trace-spec #475, trace-registry #123, weight-custody-manifest #182, and agentrust-telemetry #79, I re-read the default-branch workflow sources for the relevant release paths. No workflow was executed and no live environment settings were inspected in this pass.
Repository Current source observation Unverified / remaining action trace-registry publish.ymlnow depends on reusableci.ymlvalidation, verifies build artifacts, and defaults manual dispatch to build-only.Verify live pypiprotection and trusted-publisher binding.agentrust-telemetry release.ymldepends on CI, tests the final npm tarball, and separatespypi/npmpublication jobs.Verify both publishing environments, registry bindings, and backup operators. weight-custody-manifest publish.ymluses manual dispatch only for validation/build; the PyPI job is limited to published-release events.Verify live environment approval and registry/operator coverage. agent-manifest publish.ymlstill permits manual dispatch to reach publication and the publish job has no explicit environment binding; no release-CI prerequisite is visible.Existing approved remedy remains held for vouching; do not bypass. ca2a release.ymlbuilds and smoke-tests distributions before PyPI, but has no upstream CI dependency before build.governance-releasefollows publishing.Existing approved CI-dependency remedy remains held for vouching. As Imran ruled below, governance attestation is intentionally post-publication. Evidence boundary / decisions needed
- Workflow source is not proof of live GitHub environment protections, tag/ref deployment restrictions, self-review prevention, administrator bypass controls, exact PyPI/npm trusted-publisher bindings, or independent primary/backup operator availability. Earlier October 5 REST observations are historical; they were not retested here.
- Per Imran's scope ruling, org-level environment protection and reviewer roster decisions are separate from these repository PRs.
- Please preserve the corresponding Audit and enforce package release safeguards across AgenTrust #54 checklist items as open until maintainers attach current settings and operational evidence, coordinating backup-operator coverage with #55.
- The Agent Manifest and cA2A changes remain pending normal vouching; earlier scope approval is not a substitute for that gate.
This comment requests no new implementation scope or PR. No publishing, credentials, settings, approval authority, or review state were changed.
Source-level status, October 8. Every package in the initial scope now builds only after its tests pass at the release revision, publishes only from a matching version tag, and keeps manual runs build-only by default: trace-spec#467, cmcp#722 and #739, trace-registry#123, weight-custody-manifest#182, agentrust-telemetry#79, integrations#277, ca2a#235 and agent-manifest#491, most of them from @dinakarjs.
I re-read every release workflow on main across the eight repositories.
id-token: writesits only on the publishing jobs and on SBOM, container-push and release-asset jobs that sign attestations; no test or validation job can mint a publishing token. The conformance TestPyPI job in trace-spec is opt-in behind a repository variable, so it does not conflict with production-only publishing.That completes the fourth and fifth criteria, which I am ticking. The other five are live settings that workflow source cannot show: environment approvals and deployment-ref restrictions, trusted-publisher bindings on PyPI and npm, two operators per package (with #55), current-settings evidence, and the drift audit. They need an org owner working in the settings and the registries.
Local artifact rehearsal checkpoint — October 9, 2026
@imran-siddique — following your source-level checkpoint, I completed local build/install rehearsals for the three merged contributions on Linux/Python 3.12.14.
Contribution Exact executed merge revision Post-merge CI Local artifact checks cA2A #235 407f78e97b1f2fee01dd08e2126d40f3f8f94158Passed Wheel and sdist passed Agent Manifest #491 3cefb2f76affd6c2fefce7b4f68ca9d7d0da52f4Passed Wheel and sdist passed cMCP #739 5d09f319566004d0eb7d862b38bfa7a38583606cPassed Wheel and sdist passed Each final rehearsal used a separate temporary tooling environment, installed the repository's release-tool lock with
--require-hashes, built exactly one wheel and one sdist withpython -m build, and passedtwine check. Each artifact was then installed with runtime dependencies into its own fresh virtual environment, with checks executed outside the source tree:- cA2A: installed metadata/runtime version agreement and
ca2a --help. - Agent Manifest: installed distribution verifier with forbidden-source-root check, CLI extra, and
manifest --help. - cMCP: installed distribution verifier with forbidden-source-root check and
cmcp --help.
All 12 recorded stages per repository exited successfully. Initial package-host/resolution failures were followed by successful retries; the final run passed for all three.
SHA-256 of locally verified artifacts
ca2a_runtime-0.4.0-py3-none-any.whl 1945cb1a8e7eca844da041e9ea42aa7c127b2768d7208a439692a59f22e14422 ca2a_runtime-0.4.0.tar.gz bf4fed57773b8068a83c746ebc23c0c93ad76f24f2e7efa7cc20c92f0d18df94 agent_manifest-0.15.0-py3-none-any.whl 2cbfbb229dbe88010659b73e505c18e089ead9d49c1ae0a73e110dde8e74af02 agent_manifest-0.15.0.tar.gz b4353732891ada8c3b5bb4a59023c69dcc9cc10b6041b2a4be8d091f74d7ad1f cmcp_runtime-0.7.0-py3-none-any.whl 0ce9c8f7bcf4f20b65324d64baedfbcdbb1a598915832293d9e5827b1523ce85 cmcp_runtime-0.7.0.tar.gz 22e1b704ea24c0ab2ad0bac03b2c213f0297839a8cf2aa18780419587c507390Evidence boundary: these are local adaptations of the existing workflow artifact checks, not hosted release executions. Build backends and runtime dependencies resolve according to repository declarations; this is not a claim of fully locked or bit-identical reproducibility. cA2A has no manual build-only trigger at the pinned revision, so its rehearsal was local. No workflow was dispatched, package published, settings changed, or operator role accepted.
Live environment approvals/deployment refs, registry trusted-publisher bindings, primary/backup coverage, current-settings evidence and continuing audit work remain open under #54/#55. Logs, the local runner and verified artifacts are retained in my evidence package; they are not attached to this comment.
For a continuing contribution, would a bounded release-workflow drift regression lane under the existing requirements be useful? I would first inventory the current guard/parity tests to avoid duplication. Please identify the first repository and review owner before new implementation work.
- cA2A: installed metadata/runtime version agreement and
Package publishing needs consistent release controls across AgenTrust. The repository consolidation is complete; this issue tracks the remaining safeguards sweep.
The TRACE cutover provides a verified starting point: reviewed PR #465, successful conformance publisher run, and PyPI 0.6.2. Its
conformance-pypienvironment currently has no required reviewers or deployment restrictions and allows administrator bypass, copied with explicit approval for cutover. That temporary configuration is not the desired organization-wide baseline.Initial scope: agent-manifest, cmcp, ca2a, trace-spec (root library and conformance package), trace-registry, weight-custody-manifest, integrations (capture-core and trace-adapters), and agentrust-telemetry. Re-inventory active repositories to include any additional Python, npm, container or other package publishers. Archived source repositories should have no active publishing authority.
Completion criteria:
No credentials, recovery codes or secret values belong in this issue. A successful release by Imran proves the publisher path works; it does not prove backup-operator coverage.