Provenance profile for linking a plugin bundle to a signed manifest

[imran-siddique]

I've been working on agent identity, provenance, and runtime trust through the AAIF and CoSAI communities, and through building AGT and the AgenTrust specifications. One gap that keeps coming up is surprisingly basic: when a client receives a plugin bundle, how does it verify who produced it, what exact artifact was reviewed, and whether that artifact has changed?

I deliberately waited to raise this until there was running code behind it. Turning up with a proposal and no implementation is usually how standards discussions go nowhere.

The narrow proposal is to define a portable provenance profile that lets a plugin reference a signed manifest:

{
  "extensions": {
    "com.agentrust-io.manifest": {
      "manifest_uri": "https://registry.example/manifests/demo.cose",
      "manifest_digest": "sha256:<64 lowercase hex characters>"
    }
  }
}

The two fields answer different questions:

• manifest_uri identifies where the signed manifest can be retrieved.
• manifest_digest binds the plugin to the exact bytes retrieved from that URI.

A URL alone answers neither the integrity question nor what happens when content at that URL changes.

The plugin must not carry the public key or trust anchor used to verify the manifest. That would let an untrusted bundle bootstrap its own trust. Clients and registries should apply their own trust policy.

The signed manifest then contains a source_bundle claim that binds back to the plugin bundle. For the recursive digest, only the provenance extension's own namespace is excluded. Other extensions, files, paths, and bundle content remain covered.

That gives implementations a useful set of outcomes rather than a single boolean:

• NOT_PRESENT
• INVALID
• UNRESOLVABLE
• UNVERIFIABLE
• MISMATCH
• VERIFIED

There is working code and test coverage here:

• Agent Plugins integration implementation: feat: bind Agent Plugins bundles to signed manifests agentrust-io/agent-manifest#307
• Underlying source-bundle verification: feat(sdk): read Agent Plugins bundles, and refuse to invent tool hashes (#282) agentrust-io/agent-manifest#287
• Design rationale: https://github.com/agentrust-io/agent-manifest/blob/main/docs/adr/0015-agent-plugins-signed-manifest-reference.md

The code exists so we can test the contract rather than debate a diagram.

I'm not proposing that Agent Plugins adopt the entire Agent Manifest specification, or that these become required 1.0 fields. The immediate question is whether the ecosystem needs a small, interoperable provenance contract that multiple clients and registries can implement consistently.

A few questions for the group:

1. Does this belong as a documented extension profile, or eventually as a standard field?
2. Is digesting the raw retrieved manifest bytes the right interoperability boundary?
3. Should the reverse binding cover the complete bundle, or a defined logical projection of it?
4. Is there another client or registry interested in implementing this independently so we can test interoperability rather than only our own implementation?