Document the agentdataflow trace format and add the first trace

[astrogilda]

The README says the trace schema is a TODO and data_validation/schemas/agentdataflow_trace.schema.json already defines one. This makes the README match the schema and adds the first trace under entries/, so the directory has something to validate against.

DSGAI mapping for TRACE-0001, per the README this PR adds: DSGAI06, Tool, Plugin and Agent Data Exchange Risks, at step 2, and DSGAI15, Over-Broad Context Windows and Prompt Over-Sharing, at step 4. The trace is adversarial: the agent's own record is the unreliable part. A defence would have had to read two records the agent does not write, the gateway log and the mail relay's count of 48210 bytes.

Three things I could not settle from the repository, each written so any answer is a small edit: trace_data is an array of unconstrained objects, so the first file committed sets the de facto step shape (the example proposes one and the README marks it a proposal); trace_id is a four-digit pattern, which caps the set at ten thousand and makes the id sequential; and the example is adversarial on purpose, because a benign trace never exercises the case where the record of what happened is itself the unreliable part. Per review, these three are settled alongside the schema decision with #62, not in this PR.

Edited 2026-09-14: moved the DSGAI mapping from a follow-up comment into this description, and recorded the entries/ move, as requested in review.

[astrogilda]

The README this PR adds asks the pull-request body to name which DSGAI entries a trace is evidence for, and what a defence would observe. It names 0 entries.

TRACE-0001 maps to DSGAI06, Tool, Plugin & Agent Data Exchange Risks, at step 2, and DSGAI15, Over-Broad Context Windows & Prompt Over-Sharing, at step 4. A defence would have had to read two records the agent does not write: the gateway log and the mail relay's count of 48210 bytes.

[emmanuelgjr]

Thank you for this. TRACE-0001.json validates against data_validation/schemas/agentdataflow_trace.schema.json with no errors, it's cleanly anonymized, and the adversarial case, where the agent's own record is the unreliable part, is a useful one to have. It has no self-promotion concerns. A few changes are needed before merge.

Requested changes

1. Waiting on the schema decision. This PR and #62 both define the format for agentdataflow_toolexchange_traces/. They conflict in the README and take opposite positions: yours conforms to the central schema, while #62 proposes a dataset-local one. Maintainers will pick a direction before either merges. If it goes dataset-local, we'd ask you to adapt TRACE-0001 to that format rather than drop it, since it adds the adversarial, non-MCP variety #62 is missing.
2. Put the DSGAI mapping in the PR description. The README you add requires the PR body to name the DSGAI entries and what a defence would observe. Your follow-up comment has this (DSGAI06 at step 2, DSGAI15 at step 4, plus the gateway log and relay byte count). Please move it into the description so it's on record with the merge.
3. File location. Please place the trace under entries/, matching the one-entry-per-file layout used by exploit_dataset.
4. The three open questions (step shape, the TRACE-\d{4} cap, adversarial-first): let's settle these alongside the schema decision in (1) rather than in this PR.

Thanks, and happy to re-review once the direction is set.

[emmanuelgjr]

Update: the schema-direction decision this PR was waiting on is made. #62's dataset-local format is now merged and authoritative for datasets/agentdataflow_toolexchange_traces/ — dataset-local schemas follow the exploit_dataset precedent, and the central data_validation/schemas/agentdataflow_trace.schema.json stub will be replaced with a pointer in a follow-up. A CI workflow now runs the dataset's validate.py on every PR touching the folder.

We'd like to keep TRACE-0001 rather than close this: it's the adversarial, non-MCP variety the dataset is missing (the seed entries coming in #62's follow-up are all supplier-side contract-change cases). Concretely:

1. Re-shape TRACE-0001 to the merged format: entries/DSGAI-TRACE-<slug>.json against datasets/agentdataflow_toolexchange_traces/schema.json — typed spans instead of trace_data, disposition: "adversarial", provenance.tier (from your description this is hypothetical unless each precondition can cite an independently checkable source — see the ownership rule in the merged README), and your DSGAI06/DSGAI15 mapping from the comment above moved into dsgai_mapping and the PR body.
2. Drop this PR's README changes — the merged README already documents the format.
3. python validate.py && python build_index.py locally; CI will run the same.

If you'd rather not redo it, say so and we'll convert TRACE-0001 ourselves with you credited as contributor. Thanks for the trace — the case where the agent's own record is the unreliable part is exactly what the dataset needs.

[emmanuelgjr]

As offered above, we've done the conversion on this branch rather than wait, so the trace lands today with you as contributor:

• entries/DSGAI-TRACE-overbroad-search-context-egress-self-report-gap.json, validated against the merged dataset-local schema (validate.py: 1 entry + example pass), index.csv ships with it as the dataset's first entry.
• The five steps became 7 typed spans — the tool result (s3) and the relay record (s6) are their own spans, since those two are exactly the records your trace argues a defence must read. observed_by has no schema field, so each span's summary states who records it and the observations carry the thesis.
• Findings sit where your comment mapped them: DSGAI06 on the tool result, DSGAI15 on the egress. Your four sensitivity annotations became the falsifiable security_observations, plus one stating the self-report-divergence claim directly.
• Two deliberate changes, recorded in the entry's notes: disposition is unintentional_failure — the central schema only offered benign/adversarial and no adversary appears in the flow; the merged enum has the honest value. And tier is hypothetical — a hand-constructed illustration under the dataset's ownership rule, which keeps it out of any pooled statistic while keeping it in the dataset.
• Your README changes are dropped in favor of the format documentation datasets: define the agent-trace schema and seed the first entries #62 merged; nothing else of yours changed.

If any of this misrepresents the trace — the disposition call especially — say so and we'll fix it in a follow-up; you know the trace better than we do. Thanks for the contribution and for moving the file to entries/ before we even asked twice.

[emmanuelgjr]

Converted entry validates against the merged schema, the trace's substance is unchanged from the author's original, content is fully synthetic with placeholder identifiers, and the observability-gap case is a genuinely different archetype from the seed entries. Merging.