Add EPI Recorder: TRACE Level 0 record-producer + WCM attestation-source

[mohdibrahimaiml]

Summary

Adds integrations/epilabs-epi-recorder/ for epi-recorder 4.4.3.

• TRACE: record-producer, trace_conformance_level: 0 (software-only log-import). L1/L2 are not claimed (TR-RTE-001, TR-RTE-004).
• WCM: attestation-source (no WCM conformance level; we do not verify a custody manifest).
• Digest from the Level 0 conformance run (iter_errors=0, origin.producer=epi-recorder/4.4.3): sha256:d17f305b7f3e9950614df5ae6810b86b111c6a9aa23c37c71cac5dd503da591f.

Verified tier requested

Please evaluate for Verified. Reproduction (released packages only):

pip install "epi-recorder==4.4.3" agentrust-trace agentrust-trace-tests
epi record --out demo.epi -- python -c "print('ok')"
epi export trace demo.epi --out demo.trace.json
trace-tests verify --record demo.trace.json --level 0

Also: tool_transcript.hash == sha256(.epi); tamper -> InvalidSignature.

Release artifacts: https://github.com/mohdibrahimaiml/epi-recorder/releases/tag/v4.4.3

Seal completeness (truncation through 4.4.1): https://github.com/mohdibrahimaiml/epi-recorder/blob/v4.4.3/docs/KNOWN_LIMITATIONS.md#historical-step-content-truncation-through-441

Marketplace catalog regenerated via python scripts/generate_marketplace_catalog.py on the original listing; this commit updates yaml/README/CI pin only.

Links checked

• https://github.com/mohdibrahimaiml/epi-recorder
• https://epilabs.org
• https://pypi.org/project/epi-recorder/
• https://pypi.org/project/agentrust-trace-tests/
• https://github.com/agentrust-io/trace-spec

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[mohdibrahimaiml]

@imran-siddique — EPI Recorder 4.4.1 is tagged and on GitHub Releases. This PR is the TRACE Level 0 + WCM attestation-source listing. We are requesting the Verified tier; reproduction is in the PR body (epi-recorder==4.4.1, trace-tests verify --level 0). Digest sha256:8c84baf799f0c0e59c2878d4a2a6f94941dd7f73e6965009a10c54e313a78112.

[mohdibrahimaiml]

Updating this listing from 4.4.1 to 4.4.3. While auditing seal completeness we found that sealed step content was truncated at 2000 characters through 4.4.1 — artifacts sealed on those versions are not full transcripts. 4.4.3 seals full payloads, truncates only in the viewer, and records content_truncated in the manifest; verification fails if it is true and warns for pre-4.4.2 artifacts that lack the field. 4.4.2 was withdrawn before PyPI after a regression that broke signature verification for pre-4.4.1 seals. Both are documented in CHANGELOG and KNOWN_LIMITATIONS. Reproduction and Level 0 digest updated for 4.4.3.

[mohdibrahimaiml]

4.4.3 is now on PyPI; CI is green.