Skip to content

docs(roadmap): bring the roadmap up to what actually shipped #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 2 commits into from
Aug 8, 2026
Merged

docs(roadmap): bring the roadmap up to what actually shipped #132

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dba2148
docs(roadmap): bring the roadmap up to what actually shipped
imran-siddique Aug 8, 2026
778b0f6
docs(roadmap): name the actual standards home, the LF series
imran-siddique Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 48 additions & 48 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,48 +1,48 @@
# Roadmap
## Now — v0.1 draft (June 2026)
Announced at Confidential Computing Summit, San Francisco, June 23 2026.
**In scope:**
- Full Trust Record schema: `subject`, `model`, `runtime`, `policy`, `data_class`, `tool_transcript`, `build_provenance`, `appraisal`, `transparency`, `cnf`
- Wire formats: EAT/JWT and CBOR-COSE
- Hardware roots: NVIDIA H100/Blackwell, Intel TDX, AMD SEV-SNP, Azure MAA, GCP Confidential Space, AWS Nitro
- JSON Schema and three hardware examples
- Reference implementation: cMCP Phase 1 (Cedar policy enforcement, TRACE Level 2 emission)
**Not in v0.1:** MCP profile (normative), A2A profile, vendor platform annexes, OWASP/ATLAS cross-walks, encrypted claims envelope.
## Next — v0.2 (Q3 2026)
Driven by founding-member feedback and open questions from §7 of the spec.
- **MCP profile** — normative claim shape and binding rules for MCP tool-call transcripts (`tool_transcript`); proposed for upstream contribution to MCP spec governance
- **A2A profile** — same, for Google Agent-to-Agent. The optional `delegation` link block (`parent_record_hash` + `credential_id`) has landed in the record as the foundation; A2A is now stable at v1.x, so the normative binding rules are the remaining work
- **Vendor platform annexes** — co-authored informative claim-mapping docs for NVIDIA NRAS, Intel Trust Authority, AMD CoRIM, Azure MAA, GCP Confidential Space
- **OWASP Agentic AI Top 10 cross-walk** — which TRACE claim evidences which control for each of the 10 ASIs
- **MITRE ATLAS cross-walk** — TRACE claim coverage mapped to relevant ATLAS tactics
- **Encrypted claims envelope** — normative profile for JWE / COSE-Encrypt when `data_class` requires confidential transport to verifiers (open question §7 Q5)
- **Reference to IETF AIIP** — coordinate with draft-ritz-aiip and determine disposition (open question §7 Q7)
- **cMCP Phase 2** — policy enforcement and `tool_transcript` binding; first full Trust Records
## Later — v1.0 standard (2027)
- TSC governance under CoSAI / Linux Foundation
- All §7 open questions resolved
- Complete conformance certification program
- Post-quantum signature profile (ML-DSA, tracking NIST SP 800-208)
- MCP and A2A profiles ratified and proposed to respective upstream governance bodies
- AAIF-assigned canonical profile URI replacing the provisional v0.1 tag URI
- Multi-language verification libraries (Python, TypeScript, Go, Rust)
## What TRACE will not do
- Replace RATS, EAT, SLSA, SPIFFE, SCITT, or MCP — TRACE is a profile of these
- Specify a centralized Trust Record registry — verification is designed to work without one
- Build a TEE platform — hardware support targets open silicon (TDX, SEV-SNP, NVIDIA CC) and any platform that produces RATS-conformant evidence
- Adjudicate model alignment or output correctness — TRACE proves what executed and what was in force; correctness is out of scope
## Influencing the roadmap
Open a GitHub issue with the `spec` or `roadmap` label. Contributor and community feedback from the CC Summit period (June–September 2026) has priority for v0.2 scope.
# Roadmap

Status as of August 2026. Spec **v0.2** is current ([`spec/trace-v0.2.md`](spec/trace-v0.2.md)); the `agentrust-trace` reference SDK is at **0.6.0** and the conformance suite (`agentrust-io/trace-tests`) at **0.4.1**.

## Shipped — v0.2 (July–August 2026)

- **EAT profile URI cutover** to `tag:agentrust-io.com,2026:trace-v0.2`. The v0.1 identifier named a domain this project never controlled, which RFC 4151 does not permit, so it was invalid rather than misspelled. A v0.2 verifier requires the new URI and rejects the old one; `verify_record()` enforces the cutover before any cryptographic work. Records issued under v0.1 stay verifiable against `spec/trace-v0.1.md` and the published 0.4.x releases.
- **`delegation` link block** (`parent_record_hash` + `credential_id`), optional and additive. A chain of records linked this way forms an offline-verifiable delegation DAG. This is the foundation the A2A profile binds to, not the profile itself.
- **`transparency` is optional below Level 2.** A Level 0 or Level 1 record is unanchored and has no receipt to name; that state was previously unrepresentable.
- **`azure-cvm-sev-snp` platform**, distinct from `amd-sev-snp`, because Azure runs SEV-SNP behind a Hyper-V paravisor and the runtime binding rides a vTPM AK-signed quote rather than a guest-controlled `REPORT_DATA`. A consumer keying on `runtime.platform` can tell the two roots apart.
- **Revocation at verification time** (`verify_record(..., revocation=...)`). §3.2.1 always required it; the verifier did not do it. A revocation source that cannot answer is rejected rather than treated as a pass.
- **OWASP Agentic AI Top 10 cross-walk** — [`docs/crosswalks/owasp-agentic-top-10.md`](docs/crosswalks/owasp-agentic-top-10.md).
- **Acta decision-receipt cross-walk** — [`docs/crosswalks/acta-decision-receipts.md`](docs/crosswalks/acta-decision-receipts.md).
- **Producer adapters** for AGT, cMCP, and sandboxed agent runtimes, one code path spanning Level 0 and Level 1.
- **Platform bindings documented** for AMD SEV-SNP, Intel TDX, and NVIDIA H100 ([`docs/platforms/`](docs/platforms/)). This SDK verifies the record; verification of the attestation evidence itself lives in `cmcp` and `agent-manifest`, both of which have been run against genuine hardware quotes.
- **Reference implementation.** cMCP enforces Cedar policy inside the TEE and emits signed GatewayClaims carrying `policy`, `data_class`, and `tool_transcript`.

## Next — v0.3

- **MCP profile (normative)** — claim shape and binding rules for MCP tool-call transcripts. The `tool_transcript` claim exists and is bound; what is missing is the normative rule set, for upstream contribution to MCP spec governance.
- **A2A profile (normative)** — binding rules over the `delegation` block now that A2A is stable at v1.x, including the mutual case. cA2A is the reference implementation.
- **Anchor and inclusion-proof format** — the normative format that lets a third party verify an anchor without trusting the registry operator. Specified but not published; the registry repository is private. This is the gap that makes "verifiable without trusting the operator" a claim about the future rather than the present, and it is the highest priority item on this page. Tracked in [#111](https://github.com/agentrust-io/trace-spec/issues/111).
- **Attested memory and persistent state** — a claim for agent memory integrity at runtime, digesting the whole store rather than a manifest of it. Nothing in the ecosystem measures agent memory today; every runtime treats the agent as stateless between actions.
- **MITRE ATLAS cross-walk** — TRACE claim coverage mapped to relevant ATLAS tactics.
- **Encrypted claims envelope** — normative profile for JWE / COSE-Encrypt where `data_class` requires confidential transport to verifiers (open question §7 Q5).
- **Vendor platform annexes** — co-authored informative claim-mapping docs for NVIDIA NRAS, Intel Trust Authority, AMD CoRIM, Azure MAA, GCP Confidential Space. Co-editor seats are open (§4.4); the informative platform docs in `docs/platforms/` are ours, not vendor-co-authored.
- **Disposition on IETF AIIP** — coordinate with `draft-ritz-aiip`: absorb, supersede, or coexist (open question §7 Q7).

## Later — v1.0 standard (2027)

- TSC governance under "TRACE Specification, a Series of LF Projects, LLC" (formation in progress, see [#127](https://github.com/agentrust-io/trace-spec/pull/127); §6.1 of the spec still names the superseded CoSAI plus LF-MCP-entity plan and is corrected there)
- All §7 open questions resolved
- Complete conformance certification program
- Post-quantum signature profile (ML-DSA, tracking NIST SP 800-208)
- MCP and A2A profiles ratified and proposed to their respective upstream governance bodies
- A canonical profile URI assigned by the standards home, replacing the provisional tag URI
- Multi-language verification libraries (Python, TypeScript, Go, Rust)

## What TRACE will not do

- Replace RATS, EAT, SLSA, SPIFFE, SCITT, or MCP — TRACE is a profile of these
- Specify a centralized Trust Record registry — verification is designed to work without one
- Build a TEE platform — hardware support targets open silicon (TDX, SEV-SNP, NVIDIA CC) and any platform that produces RATS-conformant evidence
- Adjudicate model alignment or output correctness — TRACE proves what executed and what was in force; correctness is out of scope

## Influencing the roadmap

Open a GitHub issue with the `spec` or `roadmap` label. Items land here when they are implemented and tested, not when they are planned; anything above the "Next" line is exercisable today.