pub async fn attest_bound_agents(
provider: &dyn AgentBindingProvider,
bound_agents: &mut [BoundAgent],
strict: bool,
) -> Result<Vec<UnboundAgent>, BindingProviderError>Expand description
Ask provider to bind all Runner-backed agents, validate every returned
receipt, and pin accepted attestations into the snapshots.
strict decides how an Unbound outcome is treated (never how a Bound
one is validated — “attestation is optional, but never wrong”):
- A
Boundoutcome is always validated through [validate_receipt]; a receipt that is present but contradicts the request (missing tools, variant mismatch, stale digest, empty resolved model) is an error in BOTH modes. - An
Unboundoutcome fails the call withBindingProviderError::AttestationRequiredwhenstrict, or is collected into the returnedUnboundAgentlist when not — the agent staysDeclarationOnly.
Per-agent outcome completeness (exactly one outcome per requested agent, no missing / duplicate / unexpected entries) stays fail-closed in both modes.