in-toto external dependency predicate - Agent Volumes

Agent Volumes external dependency declarations can be carried outside SLSA provenance subjects, materials, resolved dependencies, byproducts, and internal parameters by an optional in-toto predicate.

https://agentvolumes.org/predicates/external-dependency-declarations/v0.1

Use this predicate for declaration-plane metadata. Do not treat it as scanner evidence, resolver output, or installed-package evidence. The stable landing page for this identifier is External dependency declarations predicate v0.1. This page is the v0.1.0-rc.1 release archive copy.

Publication boundary

The predicate is optional.
It is versioned as v0.1.
It exists to preserve external dependency declarations without changing SLSA subject, material, or resolved dependency semantics.
Mapping fixtures define the expected export behavior.

Statement schema

The release archive publishes a JSON Schema for the optional in-toto Statement envelope:

https://agentvolumes.org/spec/0.1.0-rc.1/schemas/external-dependency-declarations-predicate.schema.json

The schema uses the in-toto Statement v1 envelope, binds predicateType to this URI, and keeps predicate.semantics fixed to declaration-only. The published copy is generated from schemas/external-dependency-declarations-predicate.schema.json so the repository schema remains the source of truth.

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "pkg:volume/research-agent-pack@1.4.0",
      "digest": {
        "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
      }
    }
  ],
  "predicateType": "https://agentvolumes.org/predicates/external-dependency-declarations/v0.1",
  "predicate": {
    "semantics": "declaration-only",
    "declarations": [
      {
        "declarationKey": "av-extdep-v1:sha256:70439a6f77abdfe30f4e7e59f2ed7d5404570bf4d9a7d989192e27bdf4c46bbc",
        "purl": "pkg:npm/%40modelcontextprotocol/sdk",
        "constraint": "vers:npm/>=1.7.0|<2.0.0",
        "purpose": "runtime",
        "scope": [],
        "declarationOnly": true,
        "resolvedEvidence": false
      }
    ]
  }
}