[ogasurfproject-jpg]

Adds integrations/horizonshield-musubi-trace-terms/, community tier, as described in agentrust-io discussion #66.

What it is: musubi-trace-terms-v0 reads PIC/TRACE authorizations and Trust Records unchanged and judges them against a contract and terms two parties signed, per call and overall (within_terms, outside_terms, undetermined, refused). Each authorization is checked by agentrust-trace's own intent_bridge.verify_bridge.

• Pinned to agentrust-trace==0.11.0 (tested_against). The 55 vectors run under pytest.
• The README notes that the JSON Schema in agentrust-trace 0.11.0 is older than trace-spec main (Implementation report: six verifiers written from the v0.2 text alone, run over 2,816 inputs (four findings) trace-spec#591); every result here is against the 0.11.0 release.
• Role record-consumer, Level 0, meaning only this: the two Trust Records the vectors consume unchanged (from agentrust-io/trace-registry, CC BY 4.0, attributed in NOTICE) pass trace-tests verify --level 0 with agentrust-trace-tests 0.6.2, which the tests run. It emits no Trust Record. If you would classify it differently, tell me and I will change the manifest.
• .github/workflows/horizonshield-musubi-trace-terms-conformance.yml: fixed (tested_against) and floating (latest releases), Python 3.11 to 3.13, on changes and weekly.
• The vendored files are byte for byte horizon-shield at 05b4924 (SHA-256 in the README, checked by a test). License MIT.

Run locally: pip install -e "integrations/horizonshield-musubi-trace-terms[test]" && pytest integrations/horizonshield-musubi-trace-terms/tests -q gives 75 passed (Python 3.11, 3.12, 3.13 and 3.14). validate_integrations.py, the index and catalog checks, the ruff gate and actionlint pass.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Reviewed fdbb6e9 as a community integration of the released packages. Fresh Python 3.12.14 installation resolves agentrust-trace 0.11.0, agentrust-trace-tests 0.6.2 and nenrin-verify 0.5.6; all 75 tests pass and dependencies are consistent. This includes the 55 supplied vectors, vendored hashes, CLI exit cases and Level 0 checks on the two consumed records.

The inspected boundary binds the supplied evidence to contractor-signed acts before interpreting authorization, and missing/substituted evidence retains an undetermined outcome. Preserve the README's limits: the supplied act set and executed_at are not independently observed completeness/time, revocation is not checked, and Level 0 here covers consumed records rather than an emitted-record implementation. No additional blocker found in this bounded read. The fixed/floating hosted conformance matrix is absent from the returned checks, so its execution and maintainer classification/approval remain outstanding; local success is not that gate.

[ogasurfproject-jpg]

@dinakarjs thank you for the review. The conformance matrix has now run on this head: after @imran-siddique approved the fork workflows at about 06:13 UTC, run https://github.com/agentrust-io/integrations/actions/runs/39511359122 passed all six jobs (fixed and floating, Python 3.11, 3.12 and 3.13).

The two red checks in the same batch are outside this entry. Check documentation links fails on https://github.com/arian-gogani/nobulex, which now answers 451, from integrations/nobulex/. Examples fails in weight-custody-manifest with ModuleNotFoundError: No module named 'OpenSSL': that job installed sigstore 4.5.1 (released 20 October, 15:12 UTC), which no longer requires pyOpenSSL, while the last green Examples run on main (39431137477) had sigstore 4.5.0 and pyOpenSSL 26.4.0. This PR changes no file under examples/ or integrations/nobulex/.

[dinakarjs]

The six fixed/floating conformance jobs now pass on unchanged fdbb6e9. The repository-wide failures have focused fixes submitted: #356 for model-signing/OpenSSL dependency closure (hosted WCM job passes there) and #357 for the unavailable Nobulex listing. #357's link run has no HTTP errors but encountered a separate xChk endpoint timeout, so I am not calling all link validation green. Please retain the original bounded evidence/record-consumer claims while the base fixes and normal maintainer acceptance are pending.

[dinakarjs]

Approving the bounded record-consumer/Level 0 integration source at fdbb6e9. The earlier source/contract review remains applicable; fresh Python 3.12.14 run of integrations/horizonshield-musubi-trace-terms/tests in the existing released-package environment: 75 passed. Current fixed/floating conformance matrices pass.

Repository-wide WCM/OpenSSL and Nobulex link failures are tracked by #356/#357; those fixes and a final CI rerun remain necessary before merge. This source approval is not maintainer acceptance or independently observed execution, log completeness, trusted-time or hardware evidence.

[imran-siddique]

Merged #354, which conflicts this branch on the generated README.md index and marketplace/catalog.json. Please rebase onto main and re-run scripts/generate_integration_index.py and scripts/generate_marketplace_catalog.py (LF line endings), and this merges once it is green. Nothing else needs to change.

[ogasurfproject-jpg]

@imran-siddique thank you. The branch is rebased onto main at 2fc39d9 (#354), and scripts/generate_integration_index.py and scripts/generate_marketplace_catalog.py were run again with LF endings. Apart from those two generated files, README.md and marketplace/catalog.json, the commit carries the same bytes as before the rebase. On head 04d2ffb the trace-terms conformance jobs and Validate integrations pass. The remaining red checks are the ones #356 (the OpenSSL dependency in weight-custody-manifest) and #357 (the Nobulex link) address, plus the maintainer approval gate.

[dinakarjs]

Current-head follow-through at 04d2ffb after the rebase: git diff fdbb6e9..04d2ffb -- integrations/horizonshield-musubi-trace-terms .github/workflows/horizonshield-musubi-trace-terms-conformance.yml is empty. A fresh released-package installation and run on Linux/Python 3.12.14 gives 75 passed. The integration still pins TRACE 0.11.0, trace-tests 0.6.2 and nenrin-verify 0.5.6.

Renewing bounded source approval for the unchanged integration and workflow bytes. Generated repository index/catalog changes and inherited repository-wide dependency/link fixes still need their normal current-head validation and maintainer acceptance. Preserve record-consumer/Level 0 scope and the existing completeness/time/revocation limitations; these local tests do not establish independently observed execution or hardware behavior. Reviewed with OpenAI Codex.

[carloshvp]

Approving the community integration at exact head 04d2ffbbd95ddf21be979a2a5a18f8f7e7989812 within its stated record-consumer/Level 0 scope. I compared both vendored files byte-for-byte with the declared horizon-shield source commit, read the contract/terms/act attribution and evidence-gap handling, and ran the released-package integration.

Independent Python 3.12 validation with agentrust-trace 0.11.0, agentrust-trace-tests 0.6.2 and nenrin-verify 0.5.6: all 75 tests pass, including 55 vectors, CLI outcomes, source digests and Level 0 checks on the two consumed records. All 50 manifests, compatibility, generated index/catalog parity, the CI Ruff subset and diff whitespace checks pass. The workflow has read-only contents permission and separates fixed release testing from floating drift detection.

The evaluator judges presented contractor-signed acts and the parties' signed terms. It emits no Trust Record and does not establish completeness, actual execution time, revocation state, independently observed effects, hardware truth, or legal liability. The existing README states those limits; this approval retains community tier. All commits are DCO-signed. Repository checks and maintainer policy remain merge requirements.

Reviewed with OpenAI Codex.

[rajnisht7]

@ogasurfproject-jpg kindly rebase on main and resolve conflicts

[ogasurfproject-jpg]

@rajnisht7 rebased onto main at b57ce7e (#382), and scripts/generate_integration_index.py and scripts/generate_marketplace_catalog.py were run again with LF endings. Apart from those two generated files, README.md and marketplace/catalog.json, the commit carries the same bytes as before the rebase. New head fbf91b7.

[carloshvp]

Reviewed current head fbf91b7618b7055ea09b7737e10db130594f38fd.

Revalidated the rebased submission in an isolated checkout with its released pinned dependencies: all 75 integration tests pass, including vendored-byte checks, the CLI/vector cases and consumed-record Level 0 verification. All 50 manifests, compatibility, generated index/catalog parity and whitespace checks pass. The listing remains community and record-consumer only; the README retains the limits around supplied acts, claimed execution times, revocation and hardware/runtime attribution. No code blocker found in the current diff; repository approval/merge gates remain separate.

Prepared with OpenAI Codex.