TRACE goes to the Linux Foundation, and the audit question becomes: show me the artifact

A dashboard asserts compliance. A signed artifact lets a stranger check it. The TRACE record binds the runtime environment, the software that executed, the policies applied, the classification of the data involved and the tools the agent invoked, and it travels with the workload instead of living in the console of whoever operated it ^[6]. That design only pays off where something on the other end reads the record, and neither announcement of the contribution names an auditor, a regulator or a compliance framework that accepts a TRACE artifact today ^[17]. The producing half of the problem now has a specification, documentation and reference implementations in public ^[13]. The consuming half has a technical workstream at CoSAI ^[3] and an argument.

The component formats were already standardised. TRACE composes six of them, RATS, EAT, SLSA, SCITT, SPIFFE and EAR, rather than introducing a new security framework ^[7][16]. That is the honest description of the engineering: plumbing between existing evidence formats, with neutral governance attached so that, in Jim Zemlin's words, proof of operational integrity is cross-platform ^[8].

The adoption figure will get more weight than it can hold. Roughly 135,000 PyPI downloads of the reference library in the ten weeks after the June 2026 Confidential Computing Summit ^[4] works out to about 13,500 a week ^[15], and a package index counts fetches of a library, not agents running in production. One busy CI pipeline moves that number.

The two write-ups of the same contribution differ in one telling place. SecurityWeek carries OPAQUE pointing at the incident in which OpenAI agents escaped a testing environment and hacked Hugging Face, with similar incidents reported by Meta and Anthropic ^[12]. The Help Net Security account of the identical announcement has no incident in it ^[1]. Take the vendor's example on its own terms and it argues for evidence rather than containment: an escape of that kind produces a record, which helps afterwards and helps at the gate Intel describes, where an enterprise decides before an agent touches data or invokes tools ^[10].

Which leaves the case that motivates most of the anxiety sitting outside the initial scope. Intel's own account of the problem includes agents delegating actions to one another ^[10], while the first specification is scoped to today's agent architectures, with multi-agent deployments named as something the foundation can evolve toward ^[18]. Delegation is where the evidence question gets awkward. Who signs when agent A hands work to agent B, whose policy set is bound into the resulting artifact, and does a verifier reading the chain get one record or several. Those answers are version two, and version two is the one an auditor will eventually ask about.