🤖 Agent Trust Manifest

Runtime-enforced boundaries, reproducible by third parties. Not a promise — a projection of live enforcement.

● loading hard gates tools

What is this?

This is an Agent Trust Manifest — a machine-readable declaration of what an AI agent can and cannot do, generated directly from its runtime enforcement configuration.

Unlike a self-reported promise, this manifest is a projection of live enforcement: it is built by reading the enforcement objects the running agent actually uses, not by asking the agent to describe itself. A drift test fails when the published snapshot no longer matches what the generator produces.

The manifest carries a sha256 self-hash over its own canonical JSON, so anyone can confirm that the published file is internally intact and byte-for-byte what was generated.

It is also signed: after every healthy promote, the root-owned promote service — a process the agent cannot modify — signs the published manifest.json with an Ed25519 key the agent never sees (manifest.json.sig, signing_key.pub). The self-hash proves integrity; the signature proves the file left Rain's deploy pipeline, not the agent's hands.

What this is not. There is no certification authority behind the key — it attests origin (Rain's promote service), not correctness. The receipts the manifest describes are advisory: the application, not Agent Trust, owns enforcement.

Live Manifest

Formatted

Raw JSON

Verify

Loading...

Integrity: recompute the self-hash

The sha256 field is the digest of the manifest with that field removed, serialised with sorted keys. Recompute it yourself:

# 1. Download the published manifest
curl -sS https://rain-ouroboros.github.io/rain-site/agent-trust/manifest.json -o manifest.json

# 2. Recompute the self-hash over the canonical JSON
python3 - <<'PY'
import json, hashlib
m = json.load(open("manifest.json"))
stored = m.pop("sha256")
calc = hashlib.sha256(
    json.dumps(m, sort_keys=True, ensure_ascii=False, default=str).encode()
).hexdigest()
print("stored:", stored)
print("calc:  ", calc)
print("MATCH" if stored == calc else "MISMATCH")
PY

A match proves the file is intact. To establish which system produced it, check the signature below, or regenerate the manifest from the same enforcement source and compare — which is exactly what the drift test does on every change.

Authenticity: verify the promote-service signature

manifest.json.sig is an OpenSSH signature (ssh-keygen -Y sign, namespace file) over the exact bytes of manifest.json, made by the root promote service. Verify with OpenSSH ≥ 8.2 — no other tooling needed:

B=https://rain-ouroboros.github.io/rain-site/agent-trust
curl -sSO $B/manifest.json -O $B/manifest.json.sig -O $B/signing_key.pub
printf 'ouroboros-promote %s\n' "$(cat signing_key.pub)" > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I ouroboros-promote -n file -s manifest.json.sig < manifest.json
# Good "file" signature for ouroboros-promote with ED25519 key SHA256:8zhBfyAfhCXlkxITYlA3cJ/oYF734JIJ5EA7qgr8dls

Or curl -sSO $B/verify_manifest.py && python3 verify_manifest.py, which wraps the same command. Key fingerprint to pin: SHA256:8zhBfyAfhCXlkxITYlA3cJ/oYF734JIJ5EA7qgr8dls. The private key lives root-only on the deploy host; the agent runs as an unprivileged user and cannot read or replace it.

How It Works

1. Runtime Enforcement

Every checked tool call passes through a safety supervisor. Hard gates block dangerous actions in deterministic code, before the result reaches the model.

2. Manifest Generation

The manifest is built by reading live enforcement objects — checked tools, the boundary catalog, the effective enforcement mode, and OS-level state. It reflects reality, not aspiration.

3. Self-Hash and Drift Test

The manifest hashes its own canonical JSON, and a drift test fails whenever the committed snapshot diverges from what the generator produces. Staleness becomes a test failure instead of a quiet lie.

Why This Matters

In July 2026, the first documented case of AgentBaiting was reported: 800+ fake AI Skills and MCP servers delivering malware through agent-consumed packages. The core vulnerability: agents trust what they read.

An Agent Trust Manifest is a structural answer: don't trust the agent's self-report — read the boundaries its enforcement layer actually holds, and check that the published copy still matches.

→ Source: Island Security research on AgentBaiting