Install, verify and cite Probity Vectors
Use this page to choose an installation route or identify the corpus you ran. For the verifier interface, see the verifier contract.
The tag to cite
v0.17.7, the published version named by the preferred citation in CITATION.cff. Cite its signed tag or full source commit and corpus digest when reporting a result.
The installation examples are pinned to the version above. The corpus table describes this checkout; a release tag or installed wheel identifies its own population.
This checkout prepares an unreleased source version with package metadata and criterion-document repairs. Those changes are not part of the published release. For a release run, select the matching GitHub release and PyPI wheel and source archive. Use the installation route below or build from a reviewed source checkout. The source-wheel recipe builds the verifier and harness from a reviewed checkout, then runs the installed harness outside it. Record that checkout's full commit ID. A source pin identifies selected bytes; it does not authenticate their author. The failed prior release tag is retained unchanged as historical evidence.
Install the published release
Install matching published versions:
go install github.com/probityai/agent-evidence-vectors/cmd/aee-verify@v0.17.7
uvx agent-evidence-vectors==0.17.7 --verifier "aee-verify --json"
Run the same harness from the published release checkout:
git clone https://github.com/probityai/agent-evidence-vectors
cd agent-evidence-vectors && git checkout v0.17.7
python3 packaging/run_vectors.py --verifier "aee-verify --json"
The runner guide covers the GitHub Action, its inputs and report fields. Probity Admission uses pinned corpora to check policy-engine enforcement.
If your verifier disagrees with a vector, report the run with its source revision and report. We can then check the verifier and the fixture against the same specification.
Verify a release without trusting us
Recompute the corpus digests, then check the signature and timestamp proofs:
git clone https://github.com/probityai/agent-evidence-vectors && cd agent-evidence-vectors
git checkout v0.17.7
# 1. the digest list is what the vector files on disk hash to, recomputed
python3 scripts/release-digests.py --check
# 2. the maintainer signed exactly those bytes
cosign verify-blob --key release/cosign.pub \
--signature release/CORPUS-DIGESTS.txt.sig \
--insecure-ignore-tlog=true release/CORPUS-DIGESTS.txt
# 3. an RFC 3161 authority saw that signature at a stated time
openssl ts -verify -in release/CORPUS-DIGESTS.txt.sig.tsr \
-digest "$(base64 -d release/CORPUS-DIGESTS.txt.sig | sha256sum | cut -d' ' -f1)" \
-CAfile spec/tsa-roots.pem
# 4. so did a public calendar nobody here controls
ots verify -d "$(base64 -d release/CORPUS-DIGESTS.txt.sig | sha256sum | cut -d' ' -f1)" \
release/CORPUS-DIGESTS.txt.sig.ots
Release verification explains the checks and their requirements. Its recipe must match this block exactly; scripts/distribution-gate.py checks both copies. The digest check needs only Python.
How to cite it
Name the repository URL, the corpus's suiteRevision or release tag, and its corpusDigest. Read those values from the manifest you ran. CITATION.cff supplies the citation metadata; the citation guide gives examples.
The corpora this repository ships
Choose a corpus for the format your verifier supports. Each has its own manifest, source pin and digest.
| Directory | Suite name in its manifest | What it tests |
|---|---|---|
vectors/ |
adversarial-execution-evidence-conformance |
the adversarial-execution-evidence predicate this repository vendors, tracked at in-toto/attestation#570 |
vectors-agent-audit-record/ |
agent-audit-record-conformance |
the agent audit record of draft-gilda-wimse-agent-audit-record-02: the fifty-five members of its Appendix B, each carrying its Appendix B identifier, covering the canonical form, the request-digest and write-chain recomputes, the derived agreement, the recomputed tier, and whether the decision point could evaluate |
vectors-agent-decision/ |
agent-decision-conformance |
the args_hash rule of the agent-decision predicate proposed at in-toto/attestation#554: SHA-256 over the RFC 8785 bytes of the arguments, number forms across the exponent range and the 2^53 - 1 boundary, and an args_state that keeps a redacted call apart from an unrecorded one |
vectors-aci/ |
aci |
the agent capability interface levels and their serialization |
vectors-acs-core/ |
acs-core-negative-conformance |
the mandatory profile of the agent control standard, by negative members against vendored specification text |
vectors-ai-agent-action/ |
ai-agent-action-conformance |
the AI Agent Action predicate proposed at in-toto/attestation#588, plus the canonicalization text this repository puts forward for it |
vectors-ai-generation/ |
ai-generation-v01-conformance |
the generation predicate for AI-authored code under discussion at ossf/tac#628, at specification revision 0.1.5 in its attest-only mode, with the signed attestations both upstream implementations publish, plus the text this repository proposes for the two rules that revision leaves open |
vectors-anchor-stream/ |
anchor-stream-conformance |
the anchor-stream verification contract published by aos-standard/catalog |
vectors-artifact-binding/ |
artifact-binding-conformance |
the artifact-binding contract, over three verdicts rather than two |
vectors-dependency-selection/ |
artifact-binding-conformance |
one signed record of an AI-assisted dependency change (lockfiles, instructions in force, check outputs, approval) and its refusing twins, under the dependency-selection/v1 profile |
vectors-mcp-record-contract/ |
cross-run-record-contract |
what a cross-implementation run record has to carry to mean anything |
vectors-mcp-response-phase/ |
mcp-response-phase-interception |
whether a response-phase MCP interceptor is invoked on JSON-RPC error frames, and whether its decision governs what the caller receives |
vectors-observed-effect/ |
observed-effect-conformance |
the observed-effect predicate: a mutation interval recorded from a vantage the observed party does not control, with the authority tier recomputed rather than read as a claim |
vectors-receipt-signature/ |
receipt-signature-conformance |
signed decision receipts under draft-farley-acta-signed-receipts-03: the signing input, the key's validity window and the Section 6.6 rules, judged against an external key set with and without its windows |
vectors-scitt-cose/ |
scitt-cose-carriage-conformance |
carriage of the predicate over SCITT and COSE receipts |
vectors-anchored-chain/ |
anchored-record-chain/v1 |
signed agent memory records whose head is anchored outside the store: the storage-level edits of draft-khandelwal-bmwg-agent-memory-integrity, including the ones that pass every signature check and fail only against the chain links or the anchor |
vectors-grade-floor/ |
evidence-grade-floor/v1 |
the E0-E4 evidence ladder of AAIF Observability WG issue #37, with the grade derived by the consumer: a producer-declared grade or integrity boolean never raises it, and an operationally-conformant claim needs E3 and no contradiction |
vectors-agent-change-admission/ |
agent-change-admission/v1 |
signed decisions that admit or reject a change to an AI agent's harness, in a bare DSSE carriage and an in-toto Statement carriage: pinned keys, the predicate's required fields, the gate record against the admitted flag, and stored reports against the digests the decision names |
vectors-a2a-jcs-v01/ |
a2a-agent-card-canonicalization-conformance |
RFC 8785 canonical bytes and the bytes an A2A Agent Card signature covers, vendored byte for byte from a2aproject/a2a-tck at a locked commit and corpus digest |
vectors-mcp-owasp/ |
owasp-mcp-verification-draft |
draft MCP verification requirements MCPVS-1 to MCPVS-12 and threats MCPTM-1 to MCPTM-10, minted once in one registry, with one accept and one reject observation per requirement |
vectors-source-coverage/ |
source-text-coverage/v1 |
selected source passages against a consumer-pinned capture, report, and time window |
vectors-self-reported-record/ |
self-reported-record-conformance |
a self-reported agent record: turn signatures under the named key, memory-read digests over the bytes at the named path, an attesting key outside the observed runtime's reach, ledgers that name one change set, and covering signatures on declared substrate coverage |
vectors-w3c-report/ |
w3c-report-v01-conformance |
the W3C public-agent-conformance group's v0.1 per-check report: five states, the cause vocabulary, fourteen rejection rows and roll-up claims (including a declared no-void claim), as whole reports |
The distribution gate checks the directory and suite names against the tracked manifests. Read vector counts and digests from those manifests or release/CORPUS-DIGESTS.txt. The corpus guide describes the formats and packaged readers.
Adding a corpus of your own
Add a sibling vectors-<name>/ directory using the corpus pull-request template. Include a manifest, reproducible generator, specification pin and a digest routine that works without third-party packages. Register it in the count gate and release digest list. See maintenance for the checks.
Reporting a run
Use the run form and retain the full report.
Archive and identifiers
| Surface | Identifier |
|---|---|
| Source and Go module | github.com/probityai/agent-evidence-vectors |
| Go verifier | cmd/aee-verify |
| Python package | agent-evidence-vectors |
| Releases | GitHub releases |
| Signed digests | release/CORPUS-DIGESTS.txt |
| Archive | Zenodo concept DOI, with release-specific identifiers on the archive record |