Problem
An AWARE consumer can inspect an installed agent's manifest fields, but those fields do not establish executable provenance. A locally modified/replaced agent can retain the expected id, version, secret requirement, command name, and schema while receiving credentials and sensitive workflow inputs.
For write-mode commands (mail send, Teams post, file write), automatically trusting manifest self-description is not a sufficient boundary. Consumers also need deterministic behavior when a different installed version or modified bundle already occupies the agent id; silently updating/replacing user-owned content is unsafe, while merely accepting it trusts unverified code.
Reproduction
$env:AWARE_HOME='<empty temp directory>'
aware agent install google-workspace@1.0.0
aware agent describe google-workspace --json
The describe result identifies the installed package/manifest contract but provides no registry bundle digest or signed installation attestation that can be compared with the registry release immediately before dispatch. Editing files under <AWARE_HOME>/agents/google-workspace can preserve the claimed manifest identity.
Expected
Provide an AWARE-owned installed-agent provenance contract, such as:
- registry version plus immutable bundle digest/signature from the registry index,
- installed content digest verified across the executable/package payload,
- an explicit
verified: true|false result and mismatch reason,
- exact-version install semantics that install only when absent and refuse rather than overwrite a modified/different existing bundle unless the user explicitly updates it.
The attestation must cover the code AWARE will execute, not only manifest.yaml.
Downstream
Required before FloLess can pass a connected mailbox token and RFI content to a private AWARE workflow: pawellisowski/floless.app#1090.
Problem
An AWARE consumer can inspect an installed agent's manifest fields, but those fields do not establish executable provenance. A locally modified/replaced agent can retain the expected id, version, secret requirement, command name, and schema while receiving credentials and sensitive workflow inputs.
For write-mode commands (mail send, Teams post, file write), automatically trusting manifest self-description is not a sufficient boundary. Consumers also need deterministic behavior when a different installed version or modified bundle already occupies the agent id; silently updating/replacing user-owned content is unsafe, while merely accepting it trusts unverified code.
Reproduction
The describe result identifies the installed package/manifest contract but provides no registry bundle digest or signed installation attestation that can be compared with the registry release immediately before dispatch. Editing files under
<AWARE_HOME>/agents/google-workspacecan preserve the claimed manifest identity.Expected
Provide an AWARE-owned installed-agent provenance contract, such as:
verified: true|falseresult and mismatch reason,The attestation must cover the code AWARE will execute, not only
manifest.yaml.Downstream
Required before FloLess can pass a connected mailbox token and RFI content to a private AWARE workflow: pawellisowski/floless.app#1090.