[madeinplutofabio]

Requesting the Verified tier for integrations/pic-standard-mcp-guard, following up on #351 as discussed with @rajnisht7.

Changes: adds a "Reproduce from the fixed lock" section to the integration README. No code, manifest, index, or catalog changes. tier: community is left for maintainers to change.

To reproduce, from the repository root of a fresh clone, with Python 3.11:

python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements/pic-standard-mcp-guard-fixed.txt
.venv/bin/python -m pip check
.venv/bin/python -m pip install --no-deps -e integrations/pic-standard-mcp-guard
.venv/bin/python -m pip check
.venv/bin/python -m pytest integrations/pic-standard-mcp-guard/tests -q
.venv/bin/python integrations/pic-standard-mcp-guard/examples/emit_record.py --out trust-record.json
.venv/bin/trace-tests verify --record trust-record.json --level 0

On Windows, create the environment with py -3.11 -m venv .venv and use .venv\Scripts\ in place of .venv/bin/.

Expected:

• both pip check runs report no broken requirements;
• pytest reports 157 passed;
• emit_record.py prints wrote trust-record.json (status=record-emitted, pic_decision=allowed);
• trace-tests verify reports Result: PASS (15 checks, 4 skipped).

The fixed lock pins pic-standard 0.9.1, agentrust-trace 0.11.0, agentrust-trace-adapters 0.2.0, and agentrust-trace-tests 0.6.2, all released on PyPI. The claimed scope is unchanged: Level 0, software-only, as described in the README.

[carloshvp]

Approving the reproduction instructions at exact head 7362b2c2296ffc7408140969d3e54fbb94cbd918. I followed the fixed-lock procedure in a fresh Python 3.11 environment: both pip checks pass, all 157 tests pass, emit_record.py produces the documented allowed record, and trace-tests verify --level 0 reports PASS (15 checks, 4 skipped), exactly as documented. Diff whitespace is clean and the commit is DCO-signed.

This supports the requested Verified tier for the documented Level 0/software-only integration. I prepared the manifest and generated index/catalog promotion separately in #398 for independent review; its source code is byte-identical to the executable files reproduced here.

The sample uses deterministic TEST signing keys and its local observation callback. Verification of those records does not establish hardware attestation, an independently operated target observer, or production authorization assurance. Those existing limits stay explicit.

Reviewed with OpenAI Codex.

Hosted follow-up: the failed validation job reports only the inherited marketplace count 49 versus generated 50 at this branch's base. #396 has now merged that correction. Please update this branch from main and rerun repository validation. GitHub reports maintainer edits disabled for the fork, so this update needs the author. The two failed link checks are the unchanged Nobulex HTTP 451 listing already addressed by #357; the integration's 157 tests and emitted-record checks passed independently above.

[rajnisht7]

Reproduced this end to end, both pip check runs, all 157 tests, emit_record.py, and trace-tests verify --level 0 all matched the documented output exactly

[rajnisht7]

@madeinplutofabio Kindly rebase branch on main

[madeinplutofabio]

@rajnisht7 Rebased on main (f4498eb), thanks. All checks are green and the diff is unchanged.