[madeinplutofabio]

PIC Standard MCP Guard

A community TRACE record-producer integration for PIC Standard. PIC gates an agent's MCP tool calls before they run; this adapter turns a PIC allow decision, combined with a separately produced and caller-verified post-dispatch observation, into a signed TRACE Level 0 Trust Record linked through a detached authorization bridge.

How it works

• An outer coordinator requires a PIC proposal and the reserved __pic_request_id, and drives the released PIC 0.9.1 on_allow MCP pre-execution hook with default-on live-argument binding.
• Inside the hook, before dispatch, it builds and verifies a detached pic-trace-bridge-v1 authorization whose authorization_id is the SHA-256 of PIC's own decision bytes.
• After the tool runs and a caller-supplied observation verifier returns established, it signs a Level 0 Trust Record referencing that bridge and self-verifies the whole bundle before returning it.
• The relying-party verification path uses only agentrust-trace, rfc8785, and the standard library; it does not import or invoke pic_standard or agentrust_trace_adapters. The installed integration distribution still includes the producer dependencies.

Scope and verification

• TRACE only, Community tier, TRACE Level 0. Released packages only.
• examples/emit_record.py emits a record that passes trace-tests verify --level 0.
• Conformance workflow with a floating lane for latest-release drift detection and a hash-locked fixed lane, on Python 3.11 through 3.13.
• 157 tests covering the maintained 22-check stage-1 contract, coordinator lifecycle and fail-closed classification, context-store behavior, artifact tampering, replay boundaries, and verifier import independence.

What it does not claim

• No hardware evidence. runtime.platform is software-only; the deterministic test keys must never be used in production.
• No PIC-native authorization signature. The bridge signature authenticates the adapter's translation of PIC's decision, not a PIC-issued signature.
• No TRACE Level 1 and no independent operator. The observation is a separate code path, not a separate trusted operator.
• A PIC allow does not prove dispatch; dispatch does not prove success; a filesystem observation does not prove a general real-world outcome. Each is checked separately.
• No released TRACE successor artifact. The two-stage successor model post-dates agentrust-trace==0.11.0.
• No cMCP or Agent Manifest integration, and no portable bridge-corpus conformance.

This implements the stage-1 PIC-to-TRACE mapping previously posted on agentrust-io/awesome-ai-governance#22; the independent-maintainer review required here is the formal review point.

[imran-siddique]

Ran the fixed lane on Windows from the lock: 157 passed, emit_record.py wrote a record, and trace-tests verify --level 0 passed 15 checks with 4 skipped. Level 0 is accurate: runtime.platform is software-only and appraisal.status is none. Blanking the authorization_id comparison fails test_authorization_artifacts_tampering_detected[decision-bytes].

One change. requirements/pic-standard-mcp-guard-fixed.txt was compiled from a constraint file in a local scratchpad under C:/Users/Fabio, and there is no .in. Commit pic-standard-mcp-guard-fixed.in and regenerate it the way chap-fixed.txt is built, so anyone can rebuild the lock.

[madeinplutofabio]

@imran-siddique Thanks, fixed in 740d571. I added requirements/pic-standard-mcp-guard-fixed.in and regenerated the hash-locked .txt with the documented uv pip compile --generate-hashes --universal --python-version 3.11 command, matching the CHAP pattern. I also reran the fixed install, both pip check steps, all 157 tests, record emission, and TRACE Level 0 verification locally, all successfully.

I additionally brought the branch up to date with main and regenerated the marketplace catalog so it includes the newly merged integration (now 49), which clears the catalog --check. All checks are green apart from the maintainer-approval gate, which is awaiting your re-review.

[dinakarjs]

Reviewed exact head 6f230e5, including the lock-input follow-up to Imran's review. No additional blocker established in this community Level 0 integration.

Fresh Linux/Python 3.12 environment: hash-locked installation, --no-deps editable integration installation and pip check pass. All 157 integration tests pass; emit_record.py produces a record and trace-tests verify --level 0 reports PASS (15 checks, 4 skipped). Independently ran the documented universal Python-3.11 lock compilation: every requirement/hash line matches the committed lock (header/comments excluded). The four installed anchors are PIC 0.9.1, TRACE 0.11.0, adapters 0.2.0 and trace-tests 0.6.2. The missing-.in finding is addressed. All 14 returned exact-head workflows succeed.

Reviewed producer/coordinator, context store, detached authorization verification, record/reference/transcript binding, example and tests. Scope remains important: the bridge authenticates the adapter translation, not a PIC-native signature; record checking against its embedded cnf key establishes signature consistency, not independent recorder trust. Observation verification is a trusted callback, process-local replay tombstones are bounded and not restart/replica protection, historical bridge checking is not current authority, and Level 0 is not hardware or independent-operator evidence. None is promoted to a stronger acceptance verdict here.

References: the pinned public bridge schema/intent-bridge contract, the PR's stage-1 mapping and exact released-package inputs; RFC 8785 informs canonical identity, not external trust. This approval covers the adapter's declared scope and reproducibility, not deployment-wide enforcement or independently measured effects. Reviewed with Codex.

[imran-siddique]

Rebuilt the lock from pic-standard-mcp-guard-fixed.in with uv 0.12.19 and the command in its header: 26 packages, identical to the committed .txt apart from the header. A fresh 3.11 venv from that lock gave a clean pip check, 157 passed, and trace-tests verify --level 0 passed 15 checks with 4 skipped. The fixed job is green on 3.11 to 3.13 at 6f230e5. Approving.