[babyblueviper1]

Draft, stacked on #538: the diff against main includes #538's commit. Only the last commit, 9aaa4f2, is this PR.

What this changes

tests/test_v03_draft_schema.py in #538 reads the six manifest-reference fixtures from #487. It patches eat_profile to v0.3 before validating, because the fixtures were signed as v0.2 records. Patching after signing breaks the signature, so no checker can run the schema, the signature and the digest binding on the same record. That is item 3 of the audit on #483: integrate the reference into a conformance module, keeping the signed mismatch, unresolved, signature-first and no-manifest controls.

• Fixtures 01-05 are re-signed with tag:agentrust-io.com,2026:trace-v0.3. Same test key, same manifests, same expected outcomes.
• 06 stays a v0.2 record with no manifest, the control that verifies as today.
• Two tests, with no patching:
  • 01, 02, 04 and 05 validate against trace-claim-v0.3-draft.json exactly as signed.
  • 03 is rejected for its signed manifest_verification_result and nothing else. That is the reference-only ruling, now enforced by the schema on the signed record.
• The generator writes UTF-8 with newline="", so a Windows run reproduces the committed bytes.

Checked

• With feat(schema): add top-level manifest reference to v0.3 draft schema (#483) #538 at 75b5fbb: tests/test_v03_draft_schema.py 32/32 (27 + 5 new), and conformance/tests/test_manifest_ref_draft_vectors.py 12/12 (the four wrong checkers are still caught).
• As signed: the signatures on 01-04 and 06 verify, and 05 fails as designed.
• The schema results above hold with no eat_profile patch.
• ruff check is clean on both touched Python files.

The patch lines in #538's tests become no-ops. They can be removed in #538 or here, whichever the maintainers prefer. The sha256/sha384 contract (item 1) is not touched.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Independent approval of the bounded fixture-signing follow-up at 9aaa4f2, specifically the final eight-file commit on top of #538. The schema/generator changes inherited from #538 are not newly approved normative scope here; this remains a draft stack, not adoption of v0.3 or delivery of a production manifest-reference verifier.

Python 3.12, prepared TRACE environment, absolute PYTHONPATH to this checkout: tests/test_v03_draft_schema.py 32 passed; conformance/tests/test_manifest_ref_draft_vectors.py 12 passed. These were separate pytest invocations because the two suites have colliding tests.conftest import names. Ruff passes on both touched Python files; diff whitespace check passes.

A separate review script read the committed records without patching eat_profile, constructed JCS preimages, verified Ed25519 signatures directly, independently hashed resolved manifest bytes, and validated the draft schema. Results: 01 valid signature/schema and matching digest; 02 valid signature/schema with mismatching resolved bytes; 03 valid signature, exactly one schema error for the forbidden producer-asserted result, and a digest mismatch; 04 valid signature/schema with no resolved manifest; 05 schema-valid but signature-invalid as intended; 06 remains a validly signed v0.2 no-manifest control. The generator reproduces all six committed fixture files byte for byte.

Regression sensitivity: temporarily restoring only fixture 01 to its validly signed parent v0.2 bytes fails the new as-signed v0.3 test (1 failed, 3 passed), while preserving the signature. Fixture restored; worktree clean. The existing four wrong-checker controls also pass, meaning each incorrect checker remains detected.

Nonblocking documentation cleanup: the README's earlier byte-identical-to-2cd4ae7 statement is contradicted/corrected by the appended paragraph; consolidating it into one historical statement would read more clearly. The no-op eat_profile patches in #538's older tests can be removed when the stack is integrated. No live hardware or complete #483 acceptance claim.

[babyblueviper1]

Thanks for the independent re-derivation — appreciate the byte-level check on all six fixtures and the regression-sensitivity probe on 01. Fixed the nonblocking doc issue: consolidated the README's byte-identity statement into one accurate paragraph (97adf4a) instead of the earlier/later contradiction. Left the no-op eat_profile patch cleanup for the stack-integration pass, as you suggested.

[dinakarjs]

Follow-up at 571c142: the only change since my reviewed 9aaa4f2 is the fixture README consolidation. The contradictory byte-identity wording is resolved: 01-05 are identified as re-signed v0.3 records, 03's intentional schema rejection is retained, and 06 remains the v0.2 control. Fixtures, generator, schema and tests are unchanged, so my prior byte/signature/schema and mutation evidence remains applicable to those unchanged files; I did not rerun it for this prose-only delta. Current-head technical checks pass.

Approval remains limited to this fixture follow-up on the draft #538 stack, not adoption of v0.3, the inherited normative proposal, a production manifest verifier, or full #483 acceptance. No-op patch cleanup remains a nonblocking stack-integration task.

[babyblueviper1]

Closing: these three commits landed in main through #551 (e1560f3), rebased on the merged #538, with the fixture bytes identical to this branch's head.