The model_attestation Block for Agent Action Capsules: Model, Runtime, and Hardware Claims

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 5 April 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

An agent action recorded in an Agent Action Capsule (AAC) is executed by a model running within a specific model-serving runtime, itself invoked by an agent process in a specific execution environment, on host hardware. Two capsules recording nominally identical actions can differ in what actually happened depending on model checkpoint, quantization, sandbox confinement, or the version of a tool package the agent invoked; without a record of that environment, a forensic reviewer cannot tell a model-drift event from a compromised tool from an unconfined sandbox. The base profile [I-D.mih-scitt-agent-action-capsule] records the action, seals it under canonicalization [RFC8785], and MAY register its Capsule ID as independently transparent to a SCITT [RFC9943] Transparency Service; the agent-domain checks defined by the base profile are verified independently of that registration, by a Class 1 or Class 2 verifier, from the record's own bytes. Its epoch mechanism records baseline configuration shifts across actions. Although the base profile references a model_attestation block, it does not supply a formal definition.¶

Two constraints matter. First, this extension is payload-extension-only: model_attestation lives in the Capsule JSON like every other payload member — the base profile's Section "Extensibility" states that all Capsule extension points are in the Capsule JSON — and it does not touch the Producer Envelope's protected header, which the base profile's Section "Producer Envelope wire profile" holds closed to exactly three entries (Section 3.1). Second, this extension MUST NOT change the base profile's Class 1 or Class 2 verification model (Sections 6 and 8.2); a verifier that does not implement it treats the block as informational (Section 3). This extension also imposes no mandatory transport dependency; it is silent on how a Capsule is delivered.¶

model_attestation is a bare top-level payload member name, not a namespaced one. This follows from a fact specific to this field: the base profile already refers to model_attestation by that exact bare name, twice, without defining it (in its epoch-boundary Capsule section and in its Security Considerations), so the name is already reserved by the base profile itself rather than being minted here. This document supplies the definition for a name the base profile already uses, rather than introducing a new namespaced member.¶

This document defines the model_attestation block, generalizes it to per-action use, and formalizes the model-serving runtime, agent execution environment, and hardware facts producers observe — all within the compute_attestation container (Section 4). The block is sealed directly inside the Capsule payload and participates in derived identifier generation (capsule_id).¶

The core design principle is honesty of source. A model name reported by the runtime is a claim; a weights digest computed over a loaded file is a stronger claim; a measurement signed by a hardware root of trust is stronger still. They represent distinct facts, and the record states which one it holds. A verifier that cannot resolve a claim to its stated source MUST report it as unresolved, MUST NOT report it as verified, and MUST NOT upgrade an unknown grade to a known one.¶

This block complements rather than replaces the base profile's epoch machinery: it records per-action claims in force for an action while remaining scoped to the active epoch and prevailing epoch-boundary Capsule. model_id is RECOMMENDED, not REQUIRED, in Section 3.1: the epoch-boundary Capsule already records the model transition, and an extension MUST NOT out-mandate its base.¶

2. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

Capsule, Producer Envelope, epoch, epoch-boundary Capsule, epoch_id, derived identifier, typed digest reference, and data-admission tiers are used as defined in [I-D.mih-scitt-agent-action-capsule] and [I-D.mih-sokolov-scitt-payload-binding]. Attester, Verifier, and Evidence are used in the sense of [RFC9334] where foreign platform attestation is discussed.¶

Source label:

A standardized vocabulary declaring how a claim's value was obtained: self_reported (asserted by executing software), provider_reported (returned by a remote model provider or serving API and preserved by the producer without alteration), os_reported (reported by the host operating system), computed (calculated by the producer from bytes it held), or attested (cryptographically bound inside a verifiable foreign attestation record). Additional labels MUST be namespaced.¶

Every source map in this document (at the model_attestation level and within each compute_attestation sub-object) follows the same default: if the map is omitted, or a field has no entry in it, a verifier MUST treat that field's source as self_reported. This rule is stated once here and applies wherever a source field appears below; it is not restated per sub-object.¶

3. The model_attestation Block

A Capsule payload MAY carry a member named model_attestation. The block participates in the derived identifier like every payload member: it is canonicalized under JCS [RFC8785] and covered by capsule_id. A verifier that does not implement this extension MUST ignore it for verification and MUST NOT fail a Capsule solely because it is present.¶

4. The compute_attestation Container

compute_attestation groups environment observations into five sub-objects: runtime (Section 4.1, the model-serving runtime), agent_runtime (Section 4.2, the agent's own execution environment), invocation (Section 4.3, what the model provider or serving API reported about this call), hardware (Section 4.4), and attestation_refs (Section 4.5), plus any namespaced member owned by another specification (for example x-mesh-lifecycle-v1, host_binding). runtime and agent_runtime are deliberately distinct: runtime describes the process that served the model's inference (for example, a local inference server or hosted serving stack); agent_runtime describes the process that orchestrated the action — the agent loop, its sandbox, and the tool it invoked — which may be a different process, on different infrastructure, than the one that served the model. A verifier MUST ignore members it does not recognize. A member MUST be absent rather than null when its fact is unavailable.¶

{
  "type": "example.tdx-quote-v1",
  "purpose": "hardware",
  "digest_alg": "SHA-256",
  "digest": "e3b0c442…b7852b855"
}

5. Formal CDDL Specification

The following CDDL [RFC8610] grammar formally specifies the payload schema:¶

model-attestation-block = {
  ? "model_id"            => tstr,
  ? "provider"            => tstr,
  ? "model_revision"      => tstr,
  ? "weights_digest"      => weights-digest-claim,
  ? "quantization"        => tstr,
  ? "decoding"            => decoding-params,
  ? "source"              => source-map,
  ? "compute_attestation" => compute-attestation-container,
  ? "epoch_consistency"   => "consistent" / "inconsistent"
                             / "unknown",
  * tstr                  => any
}

source-label = "self_reported" / "provider_reported" / "os_reported"
             / "computed" / "attested" / tstr

source-map = {
  * tstr => source-label
}

weights-digest-claim = {
  "digest_alg" => tstr,
  "digest"     => tstr,
  "scope"      => "file" / "tensors" / tstr
}

decoding-params = {
  ? "temperature" => float / int,
  ? "top_p"       => float / int,
  ? "seed"        => int,
  * tstr          => any
}

compute-attestation-container = {
  ? "runtime"          => runtime-claims,
  ? "agent_runtime"    => agent-runtime-claims,
  ? "invocation"       => invocation-claims,
  ? "hardware"         => hardware-claims,
  ? "attestation_refs" => [* foreign-attestation-ref],
  * tstr               => any
}

runtime-claims = {
  ? "name"               => tstr,
  ? "runtime_digest"     => tstr,
  ? "measurement_class"  => measurement-class-label,
  ? "platform_integrity" => { * tstr => any },
  ? "source"             => source-map
}

agent-runtime-claims = {
  ? "agent_type"   => tstr,
  ? "framework"    => tstr,
  ? "runtime_env"  => tstr,
  ? "sandbox_type" => tstr,
  ? "tool_version" => tstr,
  ? "source"       => source-map
}

invocation-claims = {
  ? "requested_model_id"  => tstr,
  ? "resolved_model_id"   => tstr,
  ? "service_class"       => tstr,
  ? "backend_fingerprint" => tstr,
  ? "reasoning"           => { * tstr => tstr / int / float / bool },
  ? "usage"               => { * tstr => uint },
  ? "finish_status"       => tstr,
  ? "response_ref"        => { * tstr => any },
  ? "reasoning_state_ref" => { * tstr => any },
  ? "source"              => source-map
}

measurement-class-label = "self_measured" / "os_measured"
                        / "tpm_measured" / "app_attested"
                        / "mda_measured" / "tee_measured"
                        / tstr

hardware-claims = {
  ? "platform"     => tstr,
  ? "accelerator"  => tstr,
  ? "memory_bytes" => uint,
  ? "inventory"    => { * tstr => any },
  ? "source"       => source-map
}

foreign-attestation-ref = {
  "type"       => tstr,
  "purpose"    => tstr,
  "digest_alg" => tstr,
  "digest"     => tstr
}

6. Relationship to Epochs

The base profile's epoch-boundary Capsule records a macroscopic configuration shift across a registry or agent lifecycle. This block records the configuration in force for one action. The two MUST NOT contradict: a Capsule whose model_attestation names a model different from the one the prevailing epoch-boundary Capsule opened is either a producer defect or an unrecorded epoch change, and a verifier SHOULD report epoch_consistency: inconsistent regardless of what the producer stated. A producer that populates epoch_id SHOULD carry this block in the epoch-boundary Capsule with source labels, so the transition is commit-addressed as the base profile intends.¶

7. Verification

This extension adds no additional verification semantics beyond the base profile's Class 1 and Class 2 verifier checks (Sections 6 and 8.2 of [I-D.mih-scitt-agent-action-capsule]) on the sealed AAC record. When this extension is implemented, a verifier MAY apply the checks below.¶

1. Validate field shapes against Section 5 and the source map; a field without a source entry is self_reported per Section 3.¶

2. For each entry in attestation_refs, resolve type per [I-D.mih-sokolov-scitt-payload-binding]; if resolvable and the record is available, invoke the issuer's verifier and record its result and grade.¶

3. Derive per-field grades per Section 3.1, never exceeding the stated source and the foreign verifier's result.¶

4. Report epoch_consistency from the ledger context when available.¶

5. Report unknown measurement_class or source labels as unrecognized, never as equal to or higher than a known class or label.¶

6. Treat agent_runtime fields (Section 4.2) as self-reported by default and never infer confinement strength from sandbox_type's value; this document ranks no sandbox mechanism against another.¶

7. Treat invocation fields (Section 4.3) labelled provider_reported as the provider's claim preserved by the producer: a verifier MUST NOT report a provider_reported value as computed or attested, and MUST NOT report resolved_model_id as establishing model identity on its own.¶

8. Relationship to evidence stores and epistemic typing

A local evidence store MAY preserve these fields as evidence about the execution environment. The source labels in this document describe how a specific field value was obtained and are intentionally narrower than a general evidence taxonomy. An implementation that maps them onto a wider taxonomy SHOULD do so without silently upgrading them, for example:¶

• self_reported: a producer claim;¶

• provider_reported: a claim returned by a remote provider or API and preserved by the producer;¶

• os_reported: an observation attributed to an operating-system source;¶

• computed: a deterministic derivation over identified bytes; and¶

• attested: a claim supported by a separately verified attestation record.¶

Tool-call content, tool-call result content, prompt and context material, intentionally emitted rationale artifacts, human reports, semantic judgments, outcome adjudications, and regulatory obligation results are outside this block even when they concern the same action. They belong to separate records or extensions and may be linked by typed references.¶

9. Security Considerations

All claims in this block outside of an independently validated attestation_refs record are assertions made by the Capsule producer. The function of this profile is not to make those claims true but to make them specific, signed, and non-repudiable under the AAC verifier acceptance path. A producer that later serves a different model than it claimed has signed the discrepancy. Claims about which arithmetic ran (quantization, precision) cannot be verified from any record the producer alone signs; systems that need that assurance obtain it by redundancy or hardware attestation, outside this document. The same honesty-of-source discipline applies to agent_runtime (Section 4.2): sandbox_type: "unconfined" is exactly as signed and non-repudiable as any other value, which is what lets a forensic reviewer later distinguish an unconfined sandbox that was disclosed from one that was silently omitted.¶

A verifier MUST NOT round up: an unknown measurement_class, an unresolvable attestation_refs.type, or a source label it does not know is reported as unrecognized, never treated as the highest grade the verifier knows. This rule exists because the failure it prevents — a forged grade string accepted by an old verifier — is otherwise cheap.¶

10. Privacy Considerations

Every field in this block is subject to the base profile's data-admission tiers (clear-safe, digest-only, never-enters) and its default-deny posture: producers and adapters MUST classify each candidate field before admission, and MUST NOT admit a field merely because this document does not mention it.¶

model_id, provider, and decoding.seed are deployment or run parameters and clear-safe: they describe the model and its configuration, not a person. weights_digest and runtime_digest are digests of software artifacts and carry no end-user privacy exposure on their own; a producer MUST still ensure the artifact digested does not itself embed tenant- or user-identifying material — a model fine-tuned on a single tenant's private corpus is itself a sensitive artifact, and digesting it does not launder that sensitivity, so model_id and weights_digest for such a model are tier-appropriate to the tenant's own data, not automatically clear-safe.¶

agent_runtime.agent_type, .framework, .runtime_env, and .sandbox_type are ordinarily deployment constants and clear-safe. agent_runtime.tool_version is clear-safe only when the tool package identifier or digest does not itself encode end-user or tenant-identifying information (for example, a tenant-named internal tool, or a per-tenant container image tag); a producer whose tool naming does so MUST treat the field as digest-only or omit it. A producer for whom agent_type, framework, runtime_env, or sandbox_type varies per end-user request or per tenant (for example, per-tenant sandbox images keyed to a customer) MUST re-evaluate that field's tier rather than relying on the clear-safe default stated here, since a per-tenant value is then itself a tenant-correlation handle.¶

hardware.inventory is intentionally constrained to prevent device fingerprinting: device serial numbers, MAC addresses, platform UUIDs, and other persistent hardware identifiers MUST NOT appear in compute_attestation, in clear or as a digest, per Section 4.4.¶

No field defined in this block is an end-user or session identifier at any tier; none should be added without also updating this section.¶

11. Implementation Status

This section records the status of known implementations of this block at the time of posting, per [RFC7942]. It is to be removed before publication as an RFC.¶

Mesh-LLM capsule plugin (Apache-2.0, Rust and Python): a producer at the inference boundary of a peer-to-peer model-serving network. It writes compute_attestation.runtime with a SHA-256 digest of the serving binary and a measurement_class of os_measured where the host operating system can report it and self_measured otherwise, and records serving provenance (serving node, requesting party, token usage, generation parameters) under a namespaced member of compute_attestation. Quantization and hardware facts the host does not expose are recorded as absent, never fabricated. A name hash is recorded under a field name that says it is a name hash, after an earlier field name that overclaimed a weights binding was renamed. Its reference library reads model_attestation in its verifier, ledger, disclosure, and viewer paths.¶

capsule-emit (Apache-2.0, Python): the reference emitter and verifier treats model_attestation.compute_attestation as the extension container for runtime and compute facts, and other extensions (for example the OpenTelemetry correlation block of draft-palanisamy-scitt-aac-otel) are placed there today.¶

12. Conformance Vectors

This is a tier-2 (per-profile) extension in the sense of [I-D.mih-agent-accountability-conformance]: it defines its own semantics and must-fail cases on top of the tier-1 binding conformance that [I-D.mih-sokolov-scitt-payload-binding] (CPB) defines for every AAC payload member. This document is not itself a binding-layer artifact and does not register a type in the CPB Artifact Type Registry; that registry governs the type field of a typed digest reference — used here only by attestation_refs entries (Section 4.5) — a different and narrower thing than a named payload extension like model_attestation itself.¶

As of this writing, the registry structure for tier-2 (per-profile) conformance artifacts is explicitly not yet specified — [I-D.mih-agent-accountability-conformance] states plainly that this is "TBD in a future revision." This document therefore cannot cite a settled registration procedure for itself, and does not assert one. What it does provide now, so that registration is a formality once the tier-2 registry exists rather than a rewrite, is the two-sided conformance-vector set that document's discipline (Section 5) requires of any record profile: positive vectors with pinned values, and must-fail vectors that a conformant implementation MUST refuse rather than merely mismatch.¶

Positive vector (MUST be accepted, and graded per Section 3.1 and Section 4.5 without exceeding the stated source):¶

{
  "model_attestation": {
    "model_id":
      "bartowski/Hermes-2-Pro-Mistral-7B-GGUF:Q4_K_M",
    "weights_digest": { "digest_alg": "SHA-256",
                        "digest": "1993f98e…", "scope": "file" },
    "source": { "model_id": "self_reported",
                "weights_digest": "computed" },
    "compute_attestation": {
      "runtime": { "name": "mesh-llm-host-runtime 0.76.0",
        "measurement_class": "os_measured" },
      "agent_runtime": { "agent_type": "react",
                         "sandbox_type": "gvisor",
                         "tool_version": "sha256:9b7412f8…" },
      "attestation_refs": []
    }
  }
}

MUST-FAIL vectors (a conformant verifier MUST NOT grade the field above what these rules permit):¶

// (a) weights_digest present with no "source" entry: MUST default
// to self_reported, MUST NOT be treated as "computed" or "attested".
{ "model_attestation": {
    "weights_digest": { "digest_alg": "SHA-256",
                        "digest": "1993f98e…", "scope": "file" } } }

// (b) unrecognized measurement_class: MUST be reported as
// unrecognized, MUST NOT be treated as equal to or higher than any
// known class.
{ "model_attestation": { "compute_attestation": { "runtime": {
    "name": "custom-runtime 1.0",
    "measurement_class": "quantum_measured" } } } }

// (c) attestation_refs entry whose cited record does not verify: no
// field in the block may be upgraded to "attested" on account of the
// citation.
{ "model_attestation": {
    "weights_digest": { "digest_alg": "SHA-256",
                        "digest": "1993f98e…", "scope": "file" },
    "source": { "weights_digest": "attested" },
    "compute_attestation": { "attestation_refs": [
      { "type": "example.invalid-attestation-v1",
        "purpose": "hardware",
        "digest_alg": "SHA-256", "digest": "0000…" } ] } } }

// (d) agent_runtime.tool_version present with no "source" entry:
// MUST default to self_reported, MUST NOT be treated as "computed".
{ "model_attestation": { "compute_attestation": { "agent_runtime": {
    "tool_version": "sha256:9b7412f8…" } } } }

13. IANA Considerations

This document has no IANA actions. model_attestation is a bare payload member name seeded by the base profile itself (Section 3), not a namespaced extension, so the base profile's namespacing convention does not apply to the member name. Source labels and measurement classes are closed vocabularies of this document (Conventions and Section 4.1); a future revision may request IANA registries for either if independent extensions appear. Registration of this document as a conforming tier-2 profile awaits the registry work noted in Section 12.¶

14. References

Appendix A. Fix to the base profile

Revisions -04 and -05 of draft-mih-scitt-agent-action-capsule reference model_attestation in their epoch-boundary section and their security considerations without defining it, while producers and a registry entry already use the block. This document supplies the definition (Section 3, Section 3.1). The authors recommend that -06 of the base profile (a) cite this document for the definition or fold Section 3 in, and (b) name the two extension containers explicitly: namespaced top-level members for correlation/provenance extensions, and model_attestation.compute_attestation for runtime and compute extensions. Until (b) lands, implementations place namespaced extensions under model_attestation.compute_attestation as well (see Section 11).¶

Appendix B. Complete Example

The following is an example of a complete model_attestation object:¶

{
  "model_attestation": {
    "model_id":
      "bartowski/Hermes-2-Pro-Mistral-7B-GGUF:Q4_K_M",
    "provider": "mesh-llm",
    "weights_digest": {
      "digest_alg": "SHA-256",
      "digest": "1993f98e…04724b12",
      "scope": "file"
    },
    "quantization": "Q4_K_M",
    "decoding": {
      "temperature": 0.0,
      "seed": 42
    },
    "source": {
      "model_id": "self_reported",
      "weights_digest": "computed",
      "quantization": "self_reported"
    },
    "compute_attestation": {
      "runtime": {
        "name": "mesh-llm-host-runtime 0.76.0",
        "runtime_digest": "c204ac76…4f23b723",
        "measurement_class": "os_measured",
        "platform_integrity": {
          "sip_enabled": true
        },
        "source": {
          "sip_enabled": "os_reported"
        }
      },
      "agent_runtime": {
        "agent_type": "react",
        "framework": "custom-agent-loop 1.4.0",
        "runtime_env": "python:3.11-slim",
        "sandbox_type": "gvisor",
        "tool_version": "sha256:9b7412f8…12345678",
        "source": {
          "agent_type": "self_reported",
          "framework": "self_reported",
          "runtime_env": "self_reported",
          "sandbox_type": "os_reported",
          "tool_version": "computed"
        }
      },
      "invocation": {
        "requested_model_id": "hermes-2-pro-7b",
        "resolved_model_id":
          "bartowski/Hermes-2-Pro-Mistral-7B-GGUF:Q4_K_M",
        "usage": { "input_tokens": 412, "output_tokens": 88 },
        "finish_status": "completed",
        "source": {
          "requested_model_id": "self_reported",
          "resolved_model_id": "provider_reported",
          "usage": "provider_reported",
          "finish_status": "provider_reported"
        }
      },
      "hardware": {
        "platform": "apple-silicon",
        "accelerator": "Apple M4 Max",
        "memory_bytes": 28991029248,
        "source": {
          "platform": "os_reported",
          "accelerator": "os_reported",
          "memory_bytes": "os_reported"
        }
      },
      "attestation_refs": []
    },
    "epoch_consistency": "consistent"
  }
}

Appendix C. Acknowledgments

The authors thank the maintainers of the Mesh-LLM capsule plugin, whose shipping runtime measurements fixed the first two measurement classes, and the reviewers of the RATS architecture whose grading discipline Section 4.5 follows.¶

Authors' Addresses