Verifiable AI agent runtime with tamper-evident execution journals, workflow compilation, and cryptographic proofs
AegisTrace is a CLI-only workflow tool with 8 commands exposed as tools. All tools have descriptions (10-80 chars, mostly adequate) and input schemas with typed parameters. However, schemas lack depth: no enums for constrained values, minimal parameter descriptions (many under 20 chars), no output schemas documented, and no error recovery guidance. Tool names are verb-based (compile, verify, run) but descriptions are terse and lack WHEN/WHY context. No tool annotations (readOnlyHint/destructiveHint). Composition is reasonable (single responsibility per tool), but parameter documentation is sparse. Average tool score: 42/100.
Parse, normalize, verify, and seal workflow artifacts from YAML source
Inspect execution journal events with optional filtering by event index
Generate Ed25519 signing key pair for proof attestation
Create a Merkle tree attestation with Ed25519 signature for a specific journal event
Replay a workflow execution from a tamper-evident journal with hash chain verification
Execute a compiled workflow artifact with optional approval and journaling
Verify a compiled workflow artifact for structural integrity and safety
No output schemas documented. LLMs cannot infer what compile, run, replay, or prove return. Downstream tool chaining is impossible without guessing field names.
Parameter descriptions are minimal or missing. 'event' param in inspect/prove lacks range/constraint info. 'approve' in run lacks explanation of what 'guarded steps' means. LLMs cannot reason about valid inputs.
No error recovery guidance. If compile fails on invalid YAML, or run fails mid-execution, LLMs receive no hint about next steps (retry, inspect journal, check syntax). Errors are silent dead-ends.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | 2026-07-28+ | v2 |
Verify a Merkle attestation proof with Ed25519 signature validation
No tool annotations (readOnlyHint/destructiveHint). LLMs cannot distinguish safe tools (verify, inspect) from destructive ones (run, keygen). Risk of unintended side effects.
Parameter 'approve' in run is boolean with no enum or constraint. LLMs may pass invalid values. No explanation of what approval means in workflow context.