From 6b12c40088b168cfe75baac3974ea8463850718e Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Thu, 22 Oct 2026 01:52:31 +0530 Subject: [PATCH 1/5] feat(verify): add revision-bound capability evidence matrix Signed-off-by: Srinivasa Consultants --- data/capabilities.json | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 data/capabilities.json diff --git a/data/capabilities.json b/data/capabilities.json new file mode 100644 index 0000000..faeaf63 --- /dev/null +++ b/data/capabilities.json @@ -0,0 +1,38 @@ +{ + "reviewed_at": "2026-10-21", + "entries": [ + { + "project": "cA2A", + "repository": "ca2a", + "capability": "Compare the official A2A TCK baseline with the extension enabled", + "revision": "d312e90307c0fe679101afb28a43a6d19554d3f0", + "pull_request": 266, + "run": 39665799848, + "evidence_class": "synthetic", + "result": "Paired TCK runs passed 79 tests each; protected handlers were not invoked.", + "limits": "Draft, unmerged implementation. Each run skipped 156 tests and deselected 30. This is bounded interoperability evidence, not full TCK conformance or live deployment acceptance." + }, + { + "project": "TRACE Registry", + "repository": "trace-registry", + "capability": "Persist witness publication intent and fail closed on journal recovery errors", + "revision": "e70c10c05ab2b0c4f482d65332d0b8a91fc5882b", + "pull_request": 144, + "run": 39665123383, + "evidence_class": "synthetic", + "result": "The 413-test suite passed, including seven new durable-journal regression tests.", + "limits": "Draft, unmerged implementation. No live witness deployment or automated retry reconciliation is demonstrated; witness policy remains an operator decision." + }, + { + "project": "Telemetry", + "repository": "agentrust-telemetry", + "capability": "Exercise Python and TypeScript exporters through a real OpenTelemetry Collector", + "revision": "27141868bbe729c23ddd97a99aa19fe43251cc59", + "pull_request": 100, + "run": 39665486568, + "evidence_class": "synthetic", + "result": "Twelve collector cases passed across healthy delivery, 503, lost acknowledgement, partial success, duplicate replay and restart.", + "limits": "Draft, unmerged implementation. Inputs and backend are synthetic. Row-count checks and backend deduplication do not prove exactly-once delivery, full projection fidelity, queue saturation or in-flight restart behavior." + } + ] +} From a070648b4815544fb7bcd25316c6b72b2507a605 Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Thu, 22 Oct 2026 01:52:38 +0530 Subject: [PATCH 2/5] feat(verify): add revision-bound capability evidence matrix Signed-off-by: Srinivasa Consultants --- scripts/render-capabilities.mjs | 56 +++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 scripts/render-capabilities.mjs diff --git a/scripts/render-capabilities.mjs b/scripts/render-capabilities.mjs new file mode 100644 index 0000000..bdff59b --- /dev/null +++ b/scripts/render-capabilities.mjs @@ -0,0 +1,56 @@ +import { readFile, writeFile } from 'node:fs/promises'; +import { pathToFileURL } from 'node:url'; + +const start = ''; +const end = ''; +const escape = value => String(value).replaceAll('&', '&').replaceAll('<', '<') + .replaceAll('>', '>').replaceAll('"', '"').replaceAll("'", '''); + +export function render(data) { + if (!/^\d{4}-\d{2}-\d{2}$/.test(data.reviewed_at) || !Array.isArray(data.entries) || !data.entries.length) { + throw new Error('A dated, nonempty evidence inventory is required'); + } + const seen = new Set(); + const rows = data.entries.map(item => { + for (const field of ['project', 'capability', 'result', 'limits']) { + if (typeof item[field] !== 'string' || !item[field].trim()) throw new Error(`Missing ${field}`); + } + if (!/^[a-z0-9-]+$/.test(item.repository) || !/^[a-f0-9]{40}$/.test(item.revision) + || !Number.isSafeInteger(item.run) || item.run <= 0 + || !Number.isSafeInteger(item.pull_request) || item.pull_request <= 0 + || !['synthetic', 'captured', 'live'].includes(item.evidence_class)) throw new Error('Invalid evidence reference'); + const key = `${item.repository}:${item.capability}`; + if (seen.has(key)) throw new Error('Duplicate capability'); + seen.add(key); + const repo = `https://github.com/agentrust-io/${item.repository}`; + return `${escape(item.project)}${escape(item.capability)}
Source ${item.revision.slice(0, 12)}
Draft PR #${item.pull_request}${escape(item.evidence_class)}
${escape(item.result)}
Executable CI run${escape(item.limits)}`; + }); + return `${start} +
+ Evidence inventory +

Capabilities under review

+

Selected contributions with revision-specific execution evidence, reviewed ${escape(data.reviewed_at)}. These are draft implementations, not a released-product support matrix. Follow each pull request for current status.

+

Synthetic means controlled fixtures or workloads; captured means previously collected evidence; live means a documented live operation. A real collector does not make its synthetic workload live evidence. Missing rows mean not assessed here, not unsupported.

+
+ +${rows.join('\n')} +
Bounded test results and limitations
ProjectCapability and sourceValidation evidenceLimits
+
+

Run artifacts can expire. A passing run supports its recorded scope only; it does not establish conformance, production acceptance or hardware provenance. Canonical requirements remain in each project's specification.

+
+${end}`; +} + +if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { + const root = new URL('../', import.meta.url); + const data = JSON.parse(await readFile(new URL('data/capabilities.json', root), 'utf8')); + const pageUrl = new URL('verify/index.html', root); + const page = await readFile(pageUrl, 'utf8'); + if (page.split(start).length !== 2 || page.split(end).length !== 2) throw new Error('Expected one marker pair'); + const first = page.indexOf(start), last = page.indexOf(end); + if (last < first) throw new Error('Reversed markers'); + const output = page.slice(0, first) + render(data) + page.slice(last + end.length); + if (process.argv.includes('--check')) { + if (page !== output) throw new Error('Capability table is stale; run node scripts/render-capabilities.mjs'); + } else await writeFile(pageUrl, output); +} From 7a9aa5f91335743e4d6db3c39081380107810d96 Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Thu, 22 Oct 2026 01:52:45 +0530 Subject: [PATCH 3/5] feat(verify): add revision-bound capability evidence matrix Signed-off-by: Srinivasa Consultants --- scripts/render-capabilities.test.mjs | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 scripts/render-capabilities.test.mjs diff --git a/scripts/render-capabilities.test.mjs b/scripts/render-capabilities.test.mjs new file mode 100644 index 0000000..1b3eebe --- /dev/null +++ b/scripts/render-capabilities.test.mjs @@ -0,0 +1,28 @@ +import assert from 'node:assert/strict'; +import { test } from 'node:test'; +import { render } from './render-capabilities.mjs'; +const example = () => ({ reviewed_at: '2026-10-21', entries: [{ + project: '', repository: 'ca2a', capability: 'Compare A & B', + revision: 'a'.repeat(40), pull_request: 1, run: 2, evidence_class: 'synthetic', + result: 'Passed bounded suite', limits: 'Not production acceptance', +}] }); +test('escape content and pin source/run links', () => { + const html = render(example()); + assert.ok(html.includes('<script>')); + assert.ok(!html.includes('