TRACE is an open format for a signed receipt of an AI agent run — what model ran, where, under which policy, on what class of data, and which tools it called — that anyone holding the record can verify without asking the operator. The repository holds the specification, a JSON schema, test vectors and the agentrust-trace Python library. It launched as a developer preview on 23 June 2026, and the Linux Foundation announced it as an LF project on 25 August 2026, developed with AMD, Intel, Microsoft, OPAQUE and TII. Spec v0.2 is current.
TRACE
TRACE turns an AI agent run into a record someone else can check. Each Trust Record answers fixed
questions with fixed fields — the model (model.model_id, model.weights_digest), the runtime
(runtime.platform, runtime.measurement), the policy bundle and its enforcement mode, the data class, a
hash and count of the tool transcript, and an optional anchor in a SCITT transparency log.
- Signed, not yet attested - The README is explicit that a v0.2 signature proves who made a record and that it has not changed, not that its hardware claims are true; a proposed v0.3 runtime evidence profile adds processor attestation checked against the chip maker’s root certificate.
- Developer preview - Launched at the Confidential Computing Summit on 23 June 2026; the project points readers to LIMITATIONS.md before production use.
- Linux Foundation hosting - Hosted as “TRACE Specification, a Series of LF Projects, LLC”; the Linux Foundation announced the contribution on 25 August 2026, developed with AMD, Intel, Microsoft, OPAQUE and TII.
- Spec, schema, tests, library - The repository carries the specification, the JSON schema, examples, a
conformance test suite and the
agentrust-tracePython library on PyPI. - Split licensing - Specification text under the Community Specification License 1.0; code Apache 2.0.
Where it sits. TRACE carries supply-chain-style provenance to the moment an agent runs: where SLSA and in-toto attest how software was built and Sigstore signs it, TRACE attests what an agent did at runtime. Its example subjects use SPIFFE IDs, and the tools it records are typically reached over the Model Context Protocol.
