[ogasurfproject-jpg]

Adds integrations/horizonshield-ca2a-companion/, community tier, following agentrust-io discussion #65.

What it is: an offline verifier for a signed, Bitcoin-anchored log of cA2A revocation statements (unchanged), use limits, credential-use items, execution receipts and commit-reveal items. Every chain is judged by verify_chain and cA2A's own revocation check from released ca2a-runtime.

• The four cases from that discussion (revocation publication, single use across requests, portable execution receipts, a commitment step) are runnable tests: all 57 vectors grouped by case, with named holding and failing cases for each. The README says what each case proves and what it does not.
• Pinned to ca2a-runtime==0.4.0 because the at-execution verdict calls the private ca2a_runtime.delegation.credential._check_revocation. The public call is requested in verify_chain: judge revocation by snapshot membership while windows are judged at at_time ca2a#263; the entry switches to it and drops the pin when it ships. One test fails first if the private function moves or changes its signature.
• The schema's tested_against has no ca2a-runtime key, so the pin is recorded in a comment in integration.yaml, in pyproject.toml and in the workflow. If you prefer a ca2a-runtime key in the schema and compatibility.yaml, I can send that as a separate PR.
• .github/workflows/horizonshield-ca2a-companion-conformance.yml: fixed (the pins) and floating (latest ca2a-runtime), Python 3.11 to 3.13, on changes and weekly.
• The vendored files are byte for byte horizon-shield at 05b4924 (SHA-256 in the README, checked by a test); the vectors rebuild byte for byte with ca2a-runtime 0.4.0. License MIT.

Run locally: pip install -e "integrations/horizonshield-ca2a-companion[test]" && pytest integrations/horizonshield-ca2a-companion/tests -q gives 83 passed (Python 3.11, 3.12, 3.13 and 3.14). validate_integrations.py, the index and catalog checks, the ruff gate and actionlint pass.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Reviewed the integration boundary at 2191782. Fresh Python 3.12.14 installation resolves ca2a-runtime 0.4.0 and nenrin-verify 0.5.6; all 83 integration tests pass and the installed dependency set is consistent. The suite includes the vendored-byte check, deterministic vector rebuild, positive/negative cases and the private-call signature check.

The by-log-order branch explicitly verifies the chain first, then passes the caller-assembled snapshot to the pinned private revocation check. Its trust limit remains the completeness/order of the operator's log; the documented tests do not prove publication completeness, prevention of all second uses, actual execution or hardware binding. The public API follow-up remains #263. No additional blocker found in this bounded integration read, but I am withholding full approval until the named fixed/floating conformance matrix actually runs: current checks show only contributor check and approval gate, not the new test workflow.

[ogasurfproject-jpg]

@dinakarjs thank you for the review. The conformance matrix has now run on this head: after @imran-siddique approved the fork workflows at about 06:13 UTC, run https://github.com/agentrust-io/integrations/actions/runs/39511331654 passed all six jobs (fixed and floating, Python 3.11, 3.12 and 3.13).

The two red checks in the same batch are outside this entry. Check documentation links fails on https://github.com/arian-gogani/nobulex, which now answers 451, from integrations/nobulex/. Examples fails in weight-custody-manifest with ModuleNotFoundError: No module named 'OpenSSL': that job installed sigstore 4.5.1 (released 20 October, 15:12 UTC), which no longer requires pyOpenSSL, while the last green Examples run on main (39431137477) had sigstore 4.5.0 and pyOpenSSL 26.4.0. This PR changes no file under examples/ or integrations/nobulex/.

[dinakarjs]

Follow-up on the newly authorized CI: the six fixed/floating conformance jobs pass at unchanged 2191782. The two repository-wide blockers now have focused fixes proposed separately: #356 makes the model-signing/OpenSSL dependency explicit (the hosted WCM job passes there), and #357 removes the unavailable Nobulex source listing. Full-PR acceptance still needs those fixes accepted into the base and a fresh complete run; I am not treating unrelated red jobs as green.

For the machine-readable ca2a-runtime tested_against/compatibility follow-up you offered, I am preserving your ownership. The schema currently has no ca2a-runtime property and compatibility.yaml no minimum; please have maintainers select the supported minimum before implementing that policy value. #263's public API choice also remains with maintainers and your offered implementation.

[dinakarjs]

Approving the bounded community integration source at 2191782. The earlier source/contract review remains applicable; fresh Python 3.12.14 run of integrations/horizonshield-ca2a-companion/tests in the existing released-package environment: 83 passed. Current fixed/floating conformance matrices pass.

This does not clear the repository-wide CI failures: the WCM/OpenSSL and unavailable Nobulex source corrections are tracked by #356 and #357, and final CI must be rerun after those land. Maintainer acceptance remains separate. Preserve the author's compatibility metadata follow-up and the owner/contract decision for cA2A #263; this review does not establish complete operator logs, independent execution observation, trusted time or hardware assurance.