Agent observability conventions describe model, tool, and agent operations, but governance facts are commonly fragmented across policy engines, approval stores, cost modules, and audit systems. Copying those facts into ordinary traces creates two hazards: sensitive payload capture and the false inference that sampled operational telemetry is complete audit evidence. This technical report describes AgenTrust Telemetry, a backend-neutral contract for six governance event families: policy decisions, approval lifecycles, usage, classified data flows, action execution, and evidence lifecycle. The contract correlates with W3C Trace Context and OpenTelemetry without installing a provider, exporter, or competing tracing model. A metadata-only profile rejects prompts, outputs, source code, tool arguments and results, credentials, and authorization tokens by key. Durable run and action identifiers survive process and asynchronous handoffs; propagated metadata remains untrusted and does not confer identity or authority. An optional accumulator accepts events before lossy export and can be finalized into a separately verifiable TRACE record. Its completeness status is a producer assertion that the accumulator records but does not measure. The evaluated release, 0.1.0-alpha.2, ships Python and TypeScript reference SDKs over shared schemas and a portable conformance set of six valid and seven invalid fixtures. At that commit 111 Python unit tests pass and all 13 fixtures produce their expected verdicts, on September 3, 2026 and again when rerun for this edition. A defect found after the evaluation let an edited evidence snapshot be signed; it is reported beside the results it qualifies. The contribution is not another agent tracing convention; it is a narrow semantic boundary between operational observation and governance evidence whose completeness must be stated rather than inferred.
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The Python results were rerun at the evaluated commit for this edition; the TypeScript suite was not rerun. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. From Agent Observability to Governance Evidence: A Privacy-Constrained Telemetry Contract. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026agentrusttelemetry,
@@ -80,11 +81,12 @@ From Agent Observability to Governance Evidence: A Privacy-Constrained Telem
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
+ doi = {10.5281/zenodo.23022882},
url = {https://agentrust-io.com/research/agentrust-telemetry/v1/}
}
Version 1, September 27, 2026: Aligns claims with the evaluated code, positions the contract against prior governance telemetry work, and adds a post-evaluation findings section.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a manuscript dated September 3, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Agent observability conventions describe model, tool, and agent operations, but governance facts are commonly fragmented across policy engines, approval stores, cost modules, and audit systems. Copying those facts into ordinary traces creates two hazards: sensitive payload capture and the false inference that sampled operational telemetry is complete audit evidence. This technical report describes AgenTrust Telemetry, a backend-neutral contract for six governance event families: policy decisions, approval lifecycles, usage, classified data flows, action execution, and evidence lifecycle. The contract correlates with W3C Trace Context and OpenTelemetry without installing a provider, exporter, or competing tracing model. A metadata-only profile rejects prompts, outputs, source code, tool arguments and results, credentials, and authorization tokens by key. Durable run and action identifiers survive process and asynchronous handoffs; propagated metadata remains untrusted and does not confer identity or authority. An optional accumulator accepts events before lossy export and can be finalized into a separately verifiable TRACE record. Its completeness status is a producer assertion that the accumulator records but does not measure. The evaluated release, 0.1.0-alpha.2, ships Python and TypeScript reference SDKs over shared schemas and a portable conformance set of six valid and seven invalid fixtures. At that commit 111 Python unit tests pass and all 13 fixtures produce their expected verdicts, on September 3, 2026 and again when rerun for this edition. A defect found after the evaluation let an edited evidence snapshot be signed; it is reported beside the results it qualifies. The contribution is not another agent tracing convention; it is a narrow semantic boundary between operational observation and governance evidence whose completeness must be stated rather than inferred.
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The Python results were rerun at the evaluated commit for this edition; the TypeScript suite was not rerun. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. From Agent Observability to Governance Evidence: A Privacy-Constrained Telemetry Contract. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026agentrusttelemetry,
@@ -80,11 +81,12 @@ From Agent Observability to Governance Evidence: A Privacy-Constrained Telem
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
+ doi = {10.5281/zenodo.23022882},
url = {https://agentrust-io.com/research/agentrust-telemetry/v1/}
}
Version 1, September 27, 2026: Aligns claims with the evaluated code, positions the contract against prior governance telemetry work, and adds a post-evaluation findings section.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a manuscript dated September 3, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
The Agent2Agent (A2A) protocol moves tasks between agents, and its Signed Agent Card lets a client check that a domain owner issued a card. The card does not bound the authority a delegating agent passes on, establish what code a peer runs, keep a task payload from the peer's host, or leave an offline record of who delegated what to whom. This technical report describes cA2A (Confidential A2A), a trust profile layered on A2A rather than a new transport. It composes four mechanisms: signed delegation credentials whose scope can only narrow at each hop, appraisal of a peer's attestation evidence before a task is sent, a payload sealed to the channel key that evidence vouches for, and a signed per-hop provenance record linked to its parent. Attenuated delegation and provenance binding are covered by prior capability-token work and IETF drafts; the contribution here is their composition on A2A with an open implementation. We state six properties and report software experiments rerun against ca2a 0.3.1: attenuation checks over 5,400 generated chains, rejection of in-chain replay and cross-chain splicing, intersection of delegated scope with local policy, sealed-payload behavior at the cryptographic layer, structural checks on linked provenance records, and a cross-operator attestation protocol exercised with synthetic evidence. Chain verification cost about 0.22 ms per hop in this environment. These results do not show that a peer's key is confined to attested code or that attestation works across independent operators. Recorded hardware runs cover one-directional appraisal of an Intel TDX peer by an AMD SEV-SNP peer in another cloud and a same-operator mutual SEV-SNP diagnostic; mutual attestation between independent operators has not been demonstrated.
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The software experiments were rerun against ca2a 0.3.1 for this edition; no hardware run was repeated. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026ca2a,
@@ -82,11 +83,12 @@ cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
+ doi = {10.5281/zenodo.23022872},
url = {https://agentrust-io.com/research/ca2a/v1/}
}
Version 1, September 27, 2026: Narrows claims to what the code validates, reruns the experiments on ca2a 0.3.1, corrects three citations, and adds a post-evaluation findings section.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a draft dated July 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
The Agent2Agent (A2A) protocol moves tasks between agents, and its Signed Agent Card lets a client check that a domain owner issued a card. The card does not bound the authority a delegating agent passes on, establish what code a peer runs, keep a task payload from the peer's host, or leave an offline record of who delegated what to whom. This technical report describes cA2A (Confidential A2A), a trust profile layered on A2A rather than a new transport. It composes four mechanisms: signed delegation credentials whose scope can only narrow at each hop, appraisal of a peer's attestation evidence before a task is sent, a payload sealed to the channel key that evidence vouches for, and a signed per-hop provenance record linked to its parent. Attenuated delegation and provenance binding are covered by prior capability-token work and IETF drafts; the contribution here is their composition on A2A with an open implementation. We state six properties and report software experiments rerun against ca2a 0.3.1: attenuation checks over 5,400 generated chains, rejection of in-chain replay and cross-chain splicing, intersection of delegated scope with local policy, sealed-payload behavior at the cryptographic layer, structural checks on linked provenance records, and a cross-operator attestation protocol exercised with synthetic evidence. Chain verification cost about 0.22 ms per hop in this environment. These results do not show that a peer's key is confined to attested code or that attestation works across independent operators. Recorded hardware runs cover one-directional appraisal of an Intel TDX peer by an AMD SEV-SNP peer in another cloud and a same-operator mutual SEV-SNP diagnostic; mutual attestation between independent operators has not been demonstrated.
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The software experiments were rerun against ca2a 0.3.1 for this edition; no hardware run was repeated. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026ca2a,
@@ -82,11 +83,12 @@ cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
+ doi = {10.5281/zenodo.23022872},
url = {https://agentrust-io.com/research/ca2a/v1/}
}
Version 1, September 27, 2026: Narrows claims to what the code validates, reruns the experiments on ca2a 0.3.1, corrects three citations, and adds a post-evaluation findings section.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a draft dated July 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
This paper states conditions under which tool calls and agent handoffs preserve an authorized plaintext-holder boundary. This requires a protected channel bound to an appraised workload, restricted authority, enforceable downstream information-flow rules, and control over every other plaintext sink. A signature on an execution record or a valid hardware quote alone cannot establish these conditions. If a recipient cannot satisfy them, the sender must withhold the data or obtain authorization for a precisely described disclosure. This paper develops a conditional composition argument, a proposed handoff contract, and component experiments that expose failures of appraisal, supervision, and outcome inference. A composed software harness joins provisioning, diagnostic model computation, a confined agent, a mediated tool, delegated peer authentication, and exact-output disclosure. Its paired mutations expose earlier leaks despite successful final delivery; a rerun on September 27, 2026 reproduced all 36 recorded observations. All results are software results with synthetic attestation and a single operator. AgenTrust supplies relevant identity, key-release, gateway, delegation, and evidence primitives, but its present components do not demonstrate the complete property. The distinction matters most at remote tools, CPU-GPU transfers, operator-controlled key brokers, runtime changes, and audit systems.
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The composed software experiment was rerun for this edition; no hardware run was repeated. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Confidentiality Across Agent Handoffs: Conditions for preserving an inference guarantee through tools and delegation. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026confidentialhandoffs,
@@ -80,11 +81,12 @@ Confidentiality Across Agent Handoffs: Conditions for preserving an inferenc
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
+ doi = {10.5281/zenodo.23022884},
url = {https://agentrust-io.com/research/confidential-handoffs/v1/}
}
Version 1, September 27, 2026: Reframes the draft as a bounded software edition, records the rerun, updates dependency status and corrects two references.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a discussion draft dated September 19, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
This paper states conditions under which tool calls and agent handoffs preserve an authorized plaintext-holder boundary. This requires a protected channel bound to an appraised workload, restricted authority, enforceable downstream information-flow rules, and control over every other plaintext sink. A signature on an execution record or a valid hardware quote alone cannot establish these conditions. If a recipient cannot satisfy them, the sender must withhold the data or obtain authorization for a precisely described disclosure. This paper develops a conditional composition argument, a proposed handoff contract, and component experiments that expose failures of appraisal, supervision, and outcome inference. A composed software harness joins provisioning, diagnostic model computation, a confined agent, a mediated tool, delegated peer authentication, and exact-output disclosure. Its paired mutations expose earlier leaks despite successful final delivery; a rerun on September 27, 2026 reproduced all 36 recorded observations. All results are software results with synthetic attestation and a single operator. AgenTrust supplies relevant identity, key-release, gateway, delegation, and evidence primitives, but its present components do not demonstrate the complete property. The distinction matters most at remote tools, CPU-GPU transfers, operator-controlled key brokers, runtime changes, and audit systems.
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The composed software experiment was rerun for this edition; no hardware run was repeated. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Confidentiality Across Agent Handoffs: Conditions for preserving an inference guarantee through tools and delegation. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026confidentialhandoffs,
@@ -80,11 +81,12 @@ Confidentiality Across Agent Handoffs: Conditions for preserving an inferenc
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
+ doi = {10.5281/zenodo.23022884},
url = {https://agentrust-io.com/research/confidential-handoffs/v1/}
}
Version 1, September 27, 2026: Reframes the draft as a bounded software edition, records the rerun, updates dependency status and corrects two references.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a discussion draft dated September 19, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
AgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
Runtime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportModel weight custody
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
Read the reportDelegation evidence
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
Read the reportGovernance telemetry
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
Read the reportConfidential handoffs
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
Read the reportRuntime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportModel weight custody
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
Read the reportDelegation evidence
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
Read the reportGovernance telemetry
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
Read the reportConfidential handoffs
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
Read the reportThese reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.
Technical report / Version 1
+Technical report / Version 2
OPAQUE Systems
-TRACE (Trust, Runtime Attestation, and Compliance Evidence) proposes a portable record for claims about AI agent runtimes: workload identity, model, policy, data class, tool transcript, build provenance, and appraisal. It composes RATS/EAT, signatures, and transparency evidence into a format that a relying party can evaluate against its own trust policy. A valid signature establishes integrity and possession of the signing key; hardware origin additionally requires verified attestation and a binding from that evidence to the key. This technical report describes the original design and preserves the recorded software evaluation of agentrust-trace 0.2.0 and trace-tests 0.2.0. The evaluation measures canonicalization, Ed25519 signing and verification, record size, and fixture outcomes. It does not measure silicon certificate-chain appraisal or establish that the recorded runtime claims are true. The current normative specification and its implementation limits are maintained separately.
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance). AgenTrust technical report, version 1, 2026.
-Download BibTeX / Download CITATION.cff
@techreport{agentrust2026trace,
+Cite this report
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance). AgenTrust technical report, version 2, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026trace,
title = {TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance)},
author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
institution = {AgenTrust},
year = {2026},
type = {Technical report},
- note = {Version 1; not peer reviewed},
- doi = {10.5281/zenodo.23001692},
- url = {https://agentrust-io.com/research/trace/v1/}
+ note = {Version 2; not peer reviewed},
+ doi = {10.5281/zenodo.23024103},
+ url = {https://agentrust-io.com/research/trace/v2/}
}
Version history
Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
+Version history
Version 2, September 28, 2026: Corrects the related-work statement that transparency-log registration makes omitted events detectable, which contradicted the conclusion, and removes three en dashes. Results unchanged.
+Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
-File checksums. Published version files are retained; substantive revisions receive a new version.
File checksums. Published version files are retained; substantive revisions receive a new version.
Questions and corrections
Open an issue in the project repository and identify the report version and section.
Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
+Version 2, September 28, 2026: Corrects the related-work statement that transparency-log registration makes omitted events detectable, which contradicted the conclusion, and removes three en dashes. Results unchanged.
+Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 2
+OPAQUE Systems
+TRACE (Trust, Runtime Attestation, and Compliance Evidence) proposes a portable record for claims about AI agent runtimes: workload identity, model, policy, data class, tool transcript, build provenance, and appraisal. It composes RATS/EAT, signatures, and transparency evidence into a format that a relying party can evaluate against its own trust policy. A valid signature establishes integrity and possession of the signing key; hardware origin additionally requires verified attestation and a binding from that evidence to the key. This technical report describes the original design and preserves the recorded software evaluation of agentrust-trace 0.2.0 and trace-tests 0.2.0. The evaluation measures canonicalization, Ed25519 signing and verification, record size, and fixture outcomes. It does not measure silicon certificate-chain appraisal or establish that the recorded runtime claims are true. The current normative specification and its implementation limits are maintained separately.
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance). AgenTrust technical report, version 2, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026trace,
+ title = {TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance)},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 2; not peer reviewed},
+ doi = {10.5281/zenodo.23024103},
+ url = {https://agentrust-io.com/research/trace/v2/}
+}
+Version 2, September 28, 2026: Corrects the related-work statement that transparency-log registration makes omitted events detectable, which contradicted the conclusion, and removes three en dashes. Results unchanged.
+Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The software results were rerun at the evaluated commit for this edition; the hardware runs were not repeated. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Weight Custody Manifest: Portable, Attestation-Gated Custody for Proprietary Model Weights. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026weightcustodymanifest,
@@ -86,7 +86,7 @@ Weight Custody Manifest: Portable, Attestation-Gated Custody for Proprietary
}
Version 1, September 27, 2026: Adds a post-evaluation findings section, corrects the descriptions of the three skipped tests and of the memory-sweep receipt, fixes two citations, and records a software rerun at the evaluated commit.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a manuscript dated September 3, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+The source package preserves the recorded inputs and results. The software results were rerun at the evaluated commit for this edition; the hardware runs were not repeated. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Weight Custody Manifest: Portable, Attestation-Gated Custody for Proprietary Model Weights. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026weightcustodymanifest,
@@ -86,7 +86,7 @@ Weight Custody Manifest: Portable, Attestation-Gated Custody for Proprietary
}
Version 1, September 27, 2026: Adds a post-evaluation findings section, corrects the descriptions of the three skipped tests and of the memory-sweep receipt, fixes two citations, and records a software rerun at the evaluated commit.
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+Revises a manuscript dated September 3, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
-OPAQUE Systems
-{esc(q["origin"])}
\n' if q.get('origin') else '' + evidence = q.get('evidence_note', 'No new experiment run or independent replication is claimed for this edition.') + rows=''.join(f'Version {h["version"]}, {human_date(h["date"])}: {esc(h["changes"])}
\n' for h in reversed(history)) + body=f''' +Technical report / Version {n}
+OPAQUE Systems
+{esc(p['abstract'])}
{esc(p['contribution'])}
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
-Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
{esc('; '.join(p['authors']))}. {esc(p['title'])}. AgenTrust technical report, version 1, 2026.
-Download BibTeX / Download CITATION.cff
{esc(citation(p))}Version 1, September 27, 2026: {esc(p['changes'])}
-Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
-File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
{esc(q['abstract'])}
{esc(q['contribution'])}
The source package preserves the recorded inputs and results. {esc(evidence)}
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
{esc('; '.join(q['authors']))}. {esc(q['title'])}. AgenTrust technical report, version {n}, 2026.
+Download BibTeX / Download CITATION.cff
{esc(citation(q))}File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
{esc(p['topic'])}
{esc(p['contribution'])}
Read the report{esc(p['topic'])}
{esc(p['contribution'])}
Read the reportAgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
These reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.