[TRACE] Config schema for TRACE emission (ADR-0032, step 4/5)

[imran-siddique]

Summary

Add the trace: config block to AGT configuration schema. Fail fast at startup if trace.emit: true but required fields are absent.

Scope

Extend the existing config schema (find the canonical config dataclass or schema file).

New trace: block:

trace:
  emit: false                     # default off
  output_path: ""                 # directory for .jwt files; optional
  endpoint: ""                    # POST endpoint; optional
  model:
    provider: ""
    model_id: ""
    version: ""
    weights_digest: ""            # sha256: or sha384: prefixed
  build_provenance:
    slsa_level: 0
    builder: ""
    digest: ""
  appraisal_verifier: ""          # URI of the verifier; optional

Note: No agent_svid field. TRACE v0.2 accepts did: URIs natively -- subject is derived from session.agent_did at session close. Key material via TRACE_PRIVATE_KEY_PEM env var only.

Startup validation (when emit: true):

• model.provider and model.model_id must be present
• build_provenance.slsa_level must be 0, 1, 2, or 3
• At least one of output_path or endpoint must be set (or warn that output goes to stdout)

Acceptance criteria

• Config dataclass / schema extended with trace: block (no agent_svid)
• Startup raises ConfigurationError with a clear message for each missing required field
• Config is serializable to dict for passing to session_to_trust_record
• Unit tests: valid config passes, missing model.provider raises, invalid slsa_level raises

References

• ADR-0032
• TRACE v0.2: agentrust-io/trace-spec PR Community announcements: Show HN, Reddit, Anthropic Discord #36
• Depends on: [TRACE] TRACE model and field mapping (ADR-0032, step 1/5) #3086, [TRACE] EAT/JWT signing (ADR-0032, step 2/5) #3087, [TRACE] TRACEAuditSink (ADR-0032, step 3/5) #3088
• Next: [TRACE] Conformance tests against trace-tests (ADR-0032, step 5/5) #3090 (conformance tests)

[imran-siddique]

Addressed by #3099. Config is TraceConfig dataclass on GovernanceConfig.trace. Fields: output_path, model_provider, model_id, model_version, �uild_provenance_slsa_level, �uild_provenance_digest, �ppraisal_verifier, data_class. No JWT fields -- agentrust-trace uses embedded Ed25519 signature in JSON, not JWT envelope. �gent_id is used directly as the DID subject -- no �gent_svid field needed.

[imran-siddique]

Closed by #3099. TraceConfig dataclass added with output_path, model_provider, model_id, model_version, build_provenance_*, appraisal_verifier, and data_class fields. Wired into GovernanceConfig.trace.