Scaffold: Agentic SpendGuard integration (community, draft for maintainer)

integrations/spendguard/.github/workflows/agentrust-conformance.yml

@@ -0,0 +1,43 @@
+# agentrust-io conformance workflow for the Agentic SpendGuard integration.
+name: agentrust conformance
+on:
+  push:
+    paths: ["integrations/spendguard/**"]
+  pull_request:
+    paths: ["integrations/spendguard/**"]
+  schedule:
+    - cron: "0 6 * * 1"   # weekly: catch drift against the latest released packages
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  conformance:
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install released agentrust-io packages
+        run: |
+          python -m pip install --upgrade pip
+          pip install agentrust-trace cmcp-runtime agentrust-trace-tests
+      - name: Install this integration
+        run: pip install -e "integrations/spendguard[test]"
+      - name: Integration tests
+        run: pytest integrations/spendguard/tests -q
+      - name: Emit a sample TRACE record
+        run: python integrations/spendguard/examples/emit_record.py --out trust-record.jwt
+      - name: TRACE conformance
+        run: trace-tests verify --record trust-record.jwt --level 0
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: conformance-${{ matrix.os }}-py${{ matrix.python }}
+          path: trust-record.jwt

integrations/spendguard/README.md

@@ -0,0 +1,37 @@
+# Agentic SpendGuard integration with TRACE + Confidential MCP
+
+Agentic SpendGuard is a spend firewall for LLM agents: it reserves budget and
+gates tool calls before the provider is called, and records each decision in a
+signed, hash-chained ledger. This integration maps those decisions onto TRACE
+Trust Records and enforces spend and approval policy at the Confidential MCP
+tool boundary.
+
+What it does NOT claim: see rule 4 in [CONTRIBUTING.md](../../CONTRIBUTING.md).
+This directory is a scaffold. The TRACE conformance level is unverified until
+the conformance workflow passes, and the tier stays `community` until maintainers
+run it end to end.
+
+## Run it
+
+Against released packages:
+
+```bash
+pip install agentrust-trace cmcp-runtime agentrust-trace-tests
+pip install spendguard-sdk            # SpendGuard SDK; see the upstream repo
+python examples/emit_record.py --out trust-record.jwt
+trace-tests verify --record trust-record.jwt --level 0
+```
+
+## What is verified
+
+- `examples/emit_record.py` produces a TRACE Trust Record from a SpendGuard
+  spend/gate decision. (TODO: implement.)
+- `tests/` exercises the mapping from SpendGuard's signed decision to TRACE
+  record fields. (TODO: implement.)
+- A reviewer reproduces a passing result by running the two commands above.
+
+## Conformance CI
+
+`.github/workflows/agentrust-conformance.yml` installs the released agentrust-io
+packages, emits a record, and runs `trace-tests verify` at the claimed level. A
+clean matrix run is the basis for the Verified tier.

integrations/spendguard/examples/emit_record.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+"""Emit a TRACE Trust Record from a SpendGuard decision.
+
+SCAFFOLD: not implemented. Wire this to SpendGuard's signed decision output and
+map it onto TRACE record fields (subject, policy.bundle_hash, cnf, signature,
+gateway.audit_chain), then write the JWT to --out. Until implemented this exits
+non-zero so the conformance step honestly reflects "not done".
+"""
+import argparse
+import sys
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--out", required=True)
+    parser.parse_args()
+    sys.stderr.write(
+        "TODO: map a signed SpendGuard spend/gate decision onto a TRACE Trust "
+        "Record and write it to --out.\n"
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

integrations/spendguard/integration.yaml

@@ -0,0 +1,20 @@
+# Scaffold for the Agentic SpendGuard integration. Fill the TODOs; the
+# conformance workflow proves the TRACE level before tier flips to verified.
+# Do not set trace_conformance_level until the workflow passes.
+name: Agentic SpendGuard
+vendor: SpendGuard
+integrates_with:
+  - trace
+  - cmcp
+description: >-
+  Spend firewall for LLM agents that reserves budget and gates tool calls before
+  the provider is called, with a signed, hash-chained decision record.
+maintainer:
+  github: m24927605
+repository: https://github.com/m24927605/agentic-spendguard
+license: Apache-2.0
+tier: community
+# trace_conformance_level: 0   # uncomment + set once the conformance workflow passes
+# tested_against:              # fill with the released versions you tested
+#   agentrust-trace: "0.2.0"
+#   cmcp-runtime: "0.3.0"

integrations/spendguard/tests/test_mapping.py

@@ -0,0 +1,7 @@
+import pytest
+
+
+@pytest.mark.skip(reason="scaffold: implement SpendGuard -> TRACE mapping test")
+def test_decision_maps_to_trace_record():
+    # TODO: assert a signed SpendGuard decision maps to the required TRACE fields.
+    ...