Technical report / Version 1
+OPAQUE Systems
+Agent observability conventions describe model, tool, and agent operations, but governance facts are commonly fragmented across policy engines, approval stores, cost modules, and audit systems. Copying those facts into ordinary traces creates two hazards: sensitive payload capture and the false inference that sampled operational telemetry is complete audit evidence. This technical report describes AgenTrust Telemetry, a backend-neutral contract for six governance event families: policy decisions, approval lifecycles, usage, classified data flows, action execution, and evidence lifecycle. The contract correlates with W3C Trace Context and OpenTelemetry without installing a provider, exporter, or competing tracing model. A metadata-only profile rejects prompts, outputs, source code, tool arguments and results, credentials, and authorization tokens by key. Durable run and action identifiers survive process and asynchronous handoffs; propagated metadata remains untrusted and does not confer identity or authority. An optional accumulator accepts events before lossy export and can be finalized into a separately verifiable TRACE record. Its completeness status is a producer assertion that the accumulator records but does not measure. The evaluated release, 0.1.0-alpha.2, ships Python and TypeScript reference SDKs over shared schemas and a portable conformance set of six valid and seven invalid fixtures. At that commit 111 Python unit tests pass and all 13 fixtures produce their expected verdicts, on September 3, 2026 and again when rerun for this edition. A defect found after the evaluation let an edited evidence snapshot be signed; it is reported beside the results it qualifies. The contribution is not another agent tracing convention; it is a narrow semantic boundary between operational observation and governance evidence whose completeness must be stated rather than inferred.
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. From Agent Observability to Governance Evidence: A Privacy-Constrained Telemetry Contract. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026agentrusttelemetry,
+ title = {From Agent Observability to Governance Evidence: A Privacy-Constrained Telemetry Contract},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/agentrust-telemetry/v1/}
+}
+Version 1, September 27, 2026: Aligns claims with the evaluated code, positions the contract against prior governance telemetry work, and adds a post-evaluation findings section.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+Agent observability conventions describe model, tool, and agent operations, but governance facts are commonly fragmented across policy engines, approval stores, cost modules, and audit systems. Copying those facts into ordinary traces creates two hazards: sensitive payload capture and the false inference that sampled operational telemetry is complete audit evidence. This technical report describes AgenTrust Telemetry, a backend-neutral contract for six governance event families: policy decisions, approval lifecycles, usage, classified data flows, action execution, and evidence lifecycle. The contract correlates with W3C Trace Context and OpenTelemetry without installing a provider, exporter, or competing tracing model. A metadata-only profile rejects prompts, outputs, source code, tool arguments and results, credentials, and authorization tokens by key. Durable run and action identifiers survive process and asynchronous handoffs; propagated metadata remains untrusted and does not confer identity or authority. An optional accumulator accepts events before lossy export and can be finalized into a separately verifiable TRACE record. Its completeness status is a producer assertion that the accumulator records but does not measure. The evaluated release, 0.1.0-alpha.2, ships Python and TypeScript reference SDKs over shared schemas and a portable conformance set of six valid and seven invalid fixtures. At that commit 111 Python unit tests pass and all 13 fixtures produce their expected verdicts, on September 3, 2026 and again when rerun for this edition. A defect found after the evaluation let an edited evidence snapshot be signed; it is reported beside the results it qualifies. The contribution is not another agent tracing convention; it is a narrow semantic boundary between operational observation and governance evidence whose completeness must be stated rather than inferred.
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. From Agent Observability to Governance Evidence: A Privacy-Constrained Telemetry Contract. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026agentrusttelemetry,
+ title = {From Agent Observability to Governance Evidence: A Privacy-Constrained Telemetry Contract},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/agentrust-telemetry/v1/}
+}
+Version 1, September 27, 2026: Aligns claims with the evaluated code, positions the contract against prior governance telemetry work, and adds a post-evaluation findings section.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+The Agent2Agent (A2A) protocol moves tasks between agents, and its Signed Agent Card lets a client check that a domain owner issued a card. The card does not bound the authority a delegating agent passes on, establish what code a peer runs, keep a task payload from the peer's host, or leave an offline record of who delegated what to whom. This technical report describes cA2A (Confidential A2A), a trust profile layered on A2A rather than a new transport. It composes four mechanisms: signed delegation credentials whose scope can only narrow at each hop, appraisal of a peer's attestation evidence before a task is sent, a payload sealed to the channel key that evidence vouches for, and a signed per-hop provenance record linked to its parent. Attenuated delegation and provenance binding are covered by prior capability-token work and IETF drafts; the contribution here is their composition on A2A with an open implementation. We state six properties and report software experiments rerun against ca2a 0.3.1: attenuation checks over 5,400 generated chains, rejection of in-chain replay and cross-chain splicing, intersection of delegated scope with local policy, sealed-payload behavior at the cryptographic layer, structural checks on linked provenance records, and a cross-operator attestation protocol exercised with synthetic evidence. Chain verification cost about 0.22 ms per hop in this environment. These results do not show that a peer's key is confined to attested code or that attestation works across independent operators. Recorded hardware runs cover one-directional appraisal of an Intel TDX peer by an AMD SEV-SNP peer in another cloud and a same-operator mutual SEV-SNP diagnostic; mutual attestation between independent operators has not been demonstrated.
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026ca2a,
+ title = {cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/ca2a/v1/}
+}
+Version 1, September 27, 2026: Narrows claims to what the code validates, reruns the experiments on ca2a 0.3.1, corrects three citations, and adds a post-evaluation findings section.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+The Agent2Agent (A2A) protocol moves tasks between agents, and its Signed Agent Card lets a client check that a domain owner issued a card. The card does not bound the authority a delegating agent passes on, establish what code a peer runs, keep a task payload from the peer's host, or leave an offline record of who delegated what to whom. This technical report describes cA2A (Confidential A2A), a trust profile layered on A2A rather than a new transport. It composes four mechanisms: signed delegation credentials whose scope can only narrow at each hop, appraisal of a peer's attestation evidence before a task is sent, a payload sealed to the channel key that evidence vouches for, and a signed per-hop provenance record linked to its parent. Attenuated delegation and provenance binding are covered by prior capability-token work and IETF drafts; the contribution here is their composition on A2A with an open implementation. We state six properties and report software experiments rerun against ca2a 0.3.1: attenuation checks over 5,400 generated chains, rejection of in-chain replay and cross-chain splicing, intersection of delegated scope with local policy, sealed-payload behavior at the cryptographic layer, structural checks on linked provenance records, and a cross-operator attestation protocol exercised with synthetic evidence. Chain verification cost about 0.22 ms per hop in this environment. These results do not show that a peer's key is confined to attested code or that attestation works across independent operators. Recorded hardware runs cover one-directional appraisal of an Intel TDX peer by an AMD SEV-SNP peer in another cloud and a same-operator mutual SEV-SNP diagnostic; mutual attestation between independent operators has not been demonstrated.
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026ca2a,
+ title = {cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/ca2a/v1/}
+}
+Version 1, September 27, 2026: Narrows claims to what the code validates, reruns the experiments on ca2a 0.3.1, corrects three citations, and adds a post-evaluation findings section.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+This paper states conditions under which tool calls and agent handoffs preserve an authorized plaintext-holder boundary. This requires a protected channel bound to an appraised workload, restricted authority, enforceable downstream information-flow rules, and control over every other plaintext sink. A signature on an execution record or a valid hardware quote alone cannot establish these conditions. If a recipient cannot satisfy them, the sender must withhold the data or obtain authorization for a precisely described disclosure. This paper develops a conditional composition argument, a proposed handoff contract, and component experiments that expose failures of appraisal, supervision, and outcome inference. A composed software harness joins provisioning, diagnostic model computation, a confined agent, a mediated tool, delegated peer authentication, and exact-output disclosure. Its paired mutations expose earlier leaks despite successful final delivery; a rerun on September 27, 2026 reproduced all 36 recorded observations. All results are software results with synthetic attestation and a single operator. AgenTrust supplies relevant identity, key-release, gateway, delegation, and evidence primitives, but its present components do not demonstrate the complete property. The distinction matters most at remote tools, CPU-GPU transfers, operator-controlled key brokers, runtime changes, and audit systems.
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Confidentiality Across Agent Handoffs: Conditions for preserving an inference guarantee through tools and delegation. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026confidentialhandoffs,
+ title = {Confidentiality Across Agent Handoffs: Conditions for preserving an inference guarantee through tools and delegation},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/confidential-handoffs/v1/}
+}
+Version 1, September 27, 2026: Reframes the draft as a bounded software edition, records the rerun, updates dependency status and corrects two references.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+This paper states conditions under which tool calls and agent handoffs preserve an authorized plaintext-holder boundary. This requires a protected channel bound to an appraised workload, restricted authority, enforceable downstream information-flow rules, and control over every other plaintext sink. A signature on an execution record or a valid hardware quote alone cannot establish these conditions. If a recipient cannot satisfy them, the sender must withhold the data or obtain authorization for a precisely described disclosure. This paper develops a conditional composition argument, a proposed handoff contract, and component experiments that expose failures of appraisal, supervision, and outcome inference. A composed software harness joins provisioning, diagnostic model computation, a confined agent, a mediated tool, delegated peer authentication, and exact-output disclosure. Its paired mutations expose earlier leaks despite successful final delivery; a rerun on September 27, 2026 reproduced all 36 recorded observations. All results are software results with synthetic attestation and a single operator. AgenTrust supplies relevant identity, key-release, gateway, delegation, and evidence primitives, but its present components do not demonstrate the complete property. The distinction matters most at remote tools, CPU-GPU transfers, operator-controlled key brokers, runtime changes, and audit systems.
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Confidentiality Across Agent Handoffs: Conditions for preserving an inference guarantee through tools and delegation. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026confidentialhandoffs,
+ title = {Confidentiality Across Agent Handoffs: Conditions for preserving an inference guarantee through tools and delegation},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/confidential-handoffs/v1/}
+}
+Version 1, September 27, 2026: Reframes the draft as a bounded software edition, records the rerun, updates dependency status and corrects two references.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
AgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
Runtime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportModel weight custody
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
Read the reportRuntime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportModel weight custody
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
Read the reportDelegation evidence
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
Read the reportGovernance telemetry
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
Read the reportConfidential handoffs
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
Read the reportThese reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.
Deploying proprietary model weights into infrastructure controlled by a customer reverses the usual confidential-computing trust problem: the model builder, rather than the infrastructure owner, supplies the secret. Existing confidential-computing stacks can attest workloads and release secrets, while model-signing systems authenticate model artifacts. Neither capability alone specifies continuing custody of a particular weight artifact after release. This technical report describes the Weight Custody Manifest (WCM), a vendor-neutral protocol and conformance model that binds an exact weight digest, an approved workload measurement, attestation policy, a fresh transport key, renewable authorization, terminal refusal and wipe evidence, and derivative lineage. WCM distinguishes cryptographic custody against software adversaries from accountability-grade controls when the infrastructure operator physically owns the machine. The evaluated Python reference implementation, version 0.28.0, supplies 91 portable conformance vectors across four levels. Its test suite produced 618 passing tests and three skips on September 3, 2026, and the same counts when rerun at the same commit for this edition. Two later findings bound those results: a published advisory showed that the evaluated key broker did not require GPU confidential-compute mode before release, and the SEV-SNP platform used for the hardware run does not enable the ciphertext hiding that the cryptographic-custody claim against a hypervisor-privileged operator requires. The contribution is a portable artifact-to-runtime custody contract with explicit lifecycle evidence, derivative accountability, and conformance, not a new attestation primitive or a certification of any deployment.
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
@@ -80,6 +81,7 @@Deploying proprietary model weights into infrastructure controlled by a customer reverses the usual confidential-computing trust problem: the model builder, rather than the infrastructure owner, supplies the secret. Existing confidential-computing stacks can attest workloads and release secrets, while model-signing systems authenticate model artifacts. Neither capability alone specifies continuing custody of a particular weight artifact after release. This technical report describes the Weight Custody Manifest (WCM), a vendor-neutral protocol and conformance model that binds an exact weight digest, an approved workload measurement, attestation policy, a fresh transport key, renewable authorization, terminal refusal and wipe evidence, and derivative lineage. WCM distinguishes cryptographic custody against software adversaries from accountability-grade controls when the infrastructure operator physically owns the machine. The evaluated Python reference implementation, version 0.28.0, supplies 91 portable conformance vectors across four levels. Its test suite produced 618 passing tests and three skips on September 3, 2026, and the same counts when rerun at the same commit for this edition. Two later findings bound those results: a published advisory showed that the evaluated key broker did not require GPU confidential-compute mode before release, and the SEV-SNP platform used for the hardware run does not enable the ciphertext hiding that the cryptographic-custody claim against a hypervisor-privileged operator requires. The contribution is a portable artifact-to-runtime custody contract with explicit lifecycle evidence, derivative accountability, and conformance, not a new attestation primitive or a certification of any deployment.
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
@@ -80,6 +81,7 @@AgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
These reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.