From Claim to Proof: SOVP Now Speaks AgenTrust TRACE

SOVP audits a provider's actual infrastructure and issues a cryptographically signed record of what it finds. AgenTrust is building TRACE, an open format for trustworthy AI agent records. Since September 22, 2026, a new bridge connects both systems: sovp-agentrust-bridge, published on PyPI as litzki-sovp-agentrust-bridge, translates a SOVP attestation result into a signed AgenTrust TRACE v0.2 Trust Record.

The package is open source. Source code: github.com/agentrust-io/integrations · litzki-systems-sovp. Package: pypi.org/project/litzki-sovp-agentrust-bridge, version 0.1.1 at the time of writing, currently 0.2.0 (11 Oct 2026).

What the bridge actually does

The bridge takes a SOVP attestation result and rewrites it as a TRACE v0.2 record. It then signs that record with Ed25519 over the canonical RFC 8785 (JCS) form. A successful verification proves exactly one thing: the record originated from the holder of that private key and remained unchanged since signing. That is a transcription and signature guarantee, explicitly separate from the measurement guarantee of a hardware attestation.

Litzki Systems signs, as operator of the SOVP attestation pipeline. The signing key is a self-provisioned Ed25519 key. In production, the operator of the SOVP instance retains it permanently.

The limits the record discloses about itself

A record is only as credible as what it honestly admits to leaving open. Four limits sit deliberately inside the record itself:

This honesty has a direct consequence: the record reaches TRACE conformance at Level 0 (TR-ENV, TR-SIG, TR-POL). Higher levels require hardware measurement or independent appraisal — guarantees that sit outside what a transcription bridge can honestly deliver.

Two proof points

Successful signature verification.

A signed record built from a SOVP result with status CERTIFIED passes trace-tests verify --record … --level 0 with eight of eight checks: environment, signature, and policy checks, all PASS. That was the state at publication with agentrust-trace-tests 0.5.1. Version 0.6.2 of the test suite adds a fourth group, TR-APR, for appraisal and counts 15 checks: 12 passed, 3 skipped, 0 failed.

Rejected tampered record.

The same record, altered afterward: data_class rewritten from internal to public, signature left untouched. The classic downgrade attack, where someone reclassifies sensitive data as public after the fact without re-signing. Result: TR-SIG FAIL, signature verification fails, exit code 1. The same rejection reproduces at the library level via agentrust_trace.verify_record, which raises an InvalidSignature exception. This exact case runs automated in CI on every run.

# Verify a signed TRACE record at Level 0
trace-tests verify --record record.json --level 0
# PASS — TR-ENV, TR-SIG, TR-POL, TR-APR (0.6.2: 15 checks, 12 passed, 3 skipped)
# A tampered record fails the same command
trace-tests verify --record tampered.json --level 0
# TR-SIG FAIL — exit code 1

Limitation (29 Oct 2026): trace-tests verify --level 0 checks the signature against the key the record itself carries in cnf.jwk. A record signed with someone else's key passes this check as well. Whether the record comes from the expected sender is shown only by verifying against the trusted public key via agentrust_trace.verify_record. Records are fresh for 24 hours from iat.

What is tested and what remains open for production

Tested and reproducible: Level-0 TRACE conformance via CI and independently via trace-tests verify. Ed25519 signature integrity end to end, including a real tamper-and-reject case, well beyond a plain schema check. Field values checked against the TRACE v0.2 schema. The canonical signature path also works with non-ASCII content from the SOVP payload.

What remains open

Open for production use: custody and rotation of the signing key sit with the operator. The bridge accepts a key path; the caller owns the key lifecycle. A hardware-measured attestation path remains for the future and requires a different measurement source than SOVP's current output. An independent appraisal layer is left to whoever needs appraisal.status beyond none. Verified marketplace status comes from an AgenTrust maintainer review, independent of SOVP. The AgenTrust maintainers granted it on 23 September 2026 after their own reproduction against 0.1.1 (PR #220).

Where the bridge is listed

The bridge is listed in the public AgenTrust Marketplace, as one of 57 entries (as of 29 October 2026). The same catalog holds the TRACE integrations the AgenTrust project maintains for Claude Code, OpenAI Agents SDK, Google ADK and LangChain, and the integrations from Microsoft's Agent Governance Toolkit. A listing describes a technical integration, not an endorsement or partnership.

Independent reproduction of version 0.2.0

Addendum (29 Oct 2026): The following wording is agreed with AgenTrust and reproduced here unchanged.

The AgenTrust maintainers independently reproduced the SOVP to TRACE bridge (litzki-sovp-agentrust-bridge 0.2.0) on 12 October 2026 against agentrust-trace 0.11.0 and agentrust-trace-tests 0.6.2. The emitted record passed TRACE conformance at Level 0 (15 checks: 12 passed, 3 skipped, 0 failed) with a verified Ed25519 signature. The three skipped checks cover two optional fields and the affirming appraisal requirement, which applies from Level 1. The digest that points from the record to the SOVP verdict document matched an independent recomputation, and changing that digest in the signed record made signature verification fail. The reproduction covers Level 0 record conformance and signature integrity only. It makes no statement about the SOVP assessment, deployment security or agent behavior, and it establishes no partnership or endorsement.

Verification record: github.com/agentrust-io/integrations/pull/295#pullrequestreview-5494622603

Why this matters for SOVP

SOVP stands for independent, cryptographically signed proof of the actual state of digital infrastructure. Finding over estimation. This bridge extends that principle into a second ecosystem. A SOVP result stays portable: it works inside the SOVP portal and outside it, now also as a TRACE record that any verifier can check independently of SOVP, with the same public key.

Where the package is listed

sovp-agentrust-bridge is listed in the AgenTrust Marketplace. SOVP itself remains documented as an IETF Informational Draft — the same layer where Google's Web Bot Auth proposal and SOVP's Ed25519 DNS anchor already point toward the same convergence: cryptographic proof over self-declaration, wherever automated systems interact without a human in the loop.

For the full protocol specification, see Sovereign Validation Protocol. For the Python reference implementation, API, and quickstart, see Developers.

The next step

If your infrastructure is not yet cryptographically anchored at Layer 0, a full SOVP scan establishes the baseline: 180+ deterministic checks, three-state verdict, no production access required. SOVP has not been a product of its own since October 2026. I am bringing the scanner's checks into my SEO reports as the basis for recommended actions: after a consultation, at your request or on my recommendation.

[/// BOOK A CALL]

Source code, PyPI package, and the full conformance test are public. Questions about integration go directly to Litzki Systems.

AUTOR-01 // THORSTEN LITZKI

Thorsten Litzki SEO, GEO and research on AI readability

I test what AI systems actually read on websites. For that I developed the Sovereign Validation Protocol and submitted it to the IETF as an Internet-Draft. The SOVP benchmark holds results from more than 1,500 domains, with the method, so you can check them.

[ABOUT LITZKI SYSTEMS][LINKEDIN NODE]