Problem
The Milestone 1 agentbom/ reference implementation does not exist yet ("new (does not exist yet)" in the worktree), so the required capability is missing: agentbom/ must provide a Trust Passport export that includes signed AEP events via passport export --format json --include-aep.
Approach
- Create the minimal
agentbom/ reference implementation.
- Add a
passport command with an export subcommand that accepts --format json and --include-aep.
- When
--include-aep is given, the JSON Trust Passport output must include the signed AEP events (embed the events as-is; do not verify or re-sign them unless already part of the existing AEP model).
- When
--include-aep is omitted, passport export --format json must still produce a valid JSON Trust Passport without the signed AEP events.
- Keep the change to the smallest number of files required; do not touch unrelated code.
Files
agentbom/ (new) — minimal implementation of passport export --format json --include-aepagentbom/passport_export_test.go (new) — test that the export includes signed AEP events when --include-aep is set and omits them otherwise
No existing files outside agentbom/ should be modified.
Acceptance criteria
go test ./agentbom/... passes (or the equivalent test command for the repo's language).- The command
passport export --format json --include-aep runs successfully and emits valid JSON containing the signed AEP events.
passport export --format json (without --include-aep) emits valid JSON and does not include signed AEP events.git status --short shows only the intended new agentbom/ files.
Notes
Problem
The Milestone 1
agentbom/reference implementation does not exist yet ("new (does not exist yet)" in the worktree), so the required capability is missing:agentbom/must provide a Trust Passport export that includes signed AEP events viapassport export --format json --include-aep.Approach
agentbom/reference implementation.passportcommand with anexportsubcommand that accepts--format jsonand--include-aep.--include-aepis given, the JSON Trust Passport output must include the signed AEP events (embed the events as-is; do not verify or re-sign them unless already part of the existing AEP model).--include-aepis omitted,passport export --format jsonmust still produce a valid JSON Trust Passport without the signed AEP events.Files
agentbom/(new) — minimal implementation ofpassport export --format json --include-aepagentbom/passport_export_test.go(new) — test that the export includes signed AEP events when--include-aepis set and omits them otherwiseNo existing files outside
agentbom/should be modified.Acceptance criteria
go test ./agentbom/...passes (or the equivalent test command for the repo's language).passport export --format json --include-aepruns successfully and emits valid JSON containing the signed AEP events.passport export --format json(without--include-aep) emits valid JSON and does not include signed AEP events.git status --shortshows only the intended newagentbom/files.Notes
echo NEEDS_HUMANis replaced with the concrete checks above.agentbom/: MCP Posture verification passes against sample agent manifest (`ver... #170", but the worktree implementation note says verify-first should return PROCEED (not NOT_YET), so [milestone Milestone 1 ]agentbom/: MCP Posture verification passes against sample agent manifest (`ver... #170 is not a prerequisite for starting.