Skip to main content

attest_bound_agents

Function attest_bound_agents 

Source
pub async fn attest_bound_agents(
    provider: &dyn AgentBindingProvider,
    bound_agents: &mut [BoundAgent],
    strict: bool,
) -> Result<Vec<UnboundAgent>, BindingProviderError>
Expand description

Ask provider to bind all Runner-backed agents, validate every returned receipt, and pin accepted attestations into the snapshots.

strict decides how an Unbound outcome is treated (never how a Bound one is validated — “attestation is optional, but never wrong”):

  • A Bound outcome is always validated through [validate_receipt]; a receipt that is present but contradicts the request (missing tools, variant mismatch, stale digest, empty resolved model) is an error in BOTH modes.
  • An Unbound outcome fails the call with BindingProviderError::AttestationRequired when strict, or is collected into the returned UnboundAgent list when not — the agent stays DeclarationOnly.

Per-agent outcome completeness (exactly one outcome per requested agent, no missing / duplicate / unexpected entries) stays fail-closed in both modes.