Evaluate a SAM identity and TRACE adapter

[imran-siddique]

Build a small adapter against a tagged Google Sovereign Agent Mesh release. Map SAM node identity and authenticated packet metadata into Agent Manifest identity and TRACE subject fields, and evaluate cMCP at the MCP sidecar boundary. Acceptance evidence: runnable fixture; identity mismatch and packet replay negative tests; no claim that SAM authentication is hardware attestation.

[imran-siddique]

Checked what this would be built against. Recommending we defer, and here is what would change my mind.

google/sam is real and not a placeholder: Apache-2.0, 748 stars, pushed today, created April 2026. So the target exists. Three things make it the wrong next piece of work rather than the wrong piece of work.

It is alpha, and moving fast. Latest tag is v0.1.0-alpha.7, and there have been 7 releases since 26 June, four of them in the ten days to 16 August. CONTRIBUTING rule 1 wants integrations pinned to a published release, and rule 5 moves anything broken for 60 days to attic/. Pinning alpha.7 means signing up to chase a pre-1.0 API that has been re-cutting roughly weekly. That is a maintenance commitment, not a one-off.

It is Go. 79% Go, 2.5% Python. There is no Go TRACE library, so this cannot be an in-process adapter. It would have to consume SAM's output after the fact, which puts it on the transcription path: origin.kind: third-party-control-plane, runtime.platform: software-only, appraisal.status: none.

The acceptance criteria already concede the ceiling. "No claim that SAM authentication is hardware attestation" is exactly right, and it means the resulting record is a Level 0 transcription of node identity and packet metadata. Honest, and thin.

Set against #96, where I just measured adoption and confirmed hook shapes: the OpenAI Agents SDK is 39.7M downloads a month, stable, and ships TracingProcessor, a genuine first-party hook. That record carries no origin block. Same effort, materially more valuable artifact.

What would flip this:

• SAM cuts a stable v0.1.0 or later, so a pin holds for more than a fortnight.
• A named customer or the sovereign thread asks for it, at which point a thin transcription record that exists beats a rich one that does not.
• Someone wants a Go TRACE library on its own merits, which would change the shape of this from transcription to first-party and is a much larger decision than one adapter.

Leaving open and unassigned rather than closing, because the target is real and the first of those three is plausibly weeks away. Worth re-checking when SAM drops the alpha suffix.