[dependabot]

Bumps agentrust-trace from 0.10.0 to 0.11.0.

Release notes

Sourced from agentrust-trace's releases.

agentrust-trace 0.11.0

Breaking

• TraceAGTAdapter and TraceSandboxAdapter require enforcement_mode. They used to default to enforce, which signed a claim that a policy was evaluated when nothing evaluated it. Callers pass the mode their runtime ran under, or declared when no engine evaluated the policy (#416, #419; diagnosis and first fix by @​solloek369-arch in #417).
• Signatures accept only canonical unpadded base64url, so one signature has one spelling. A padded or non-canonical signature that used to decode is refused (#418).

Added

• verify_record() reports whether the objects a record cites resolve (#374).
• Verifiers declare accepted_profiles, and VerificationResult records the profile it verified under (#347, for #116).
• The reproducibility claim and its re-execution appraisal in the schema and models, with 21 signed vectors (#364, #370).
• condition-appraisal is a registered references relation (#389).
• MCP Server Provenance v2 binds behavioral hints (#409).
• intent_bridge binds a successor observation by digest (#340).
• provenance.verify_record() takes now to replay a freshness decision (#411).

Fixed

• Schema patterns follow ECMA-262, so a trailing \n, \r, U+2028 or U+2029 no longer passes subject or URI checks (#388). The Pydantic models share the same patterns (#412).
• A malformed signature is reported as malformed, not missing (#390).
• Revocation bundles with no RFC 8785 form are unverified_for_revocation rather than an exception (#386).
• Non-ASCII challenge nonces raise the documented ValueError (#383).
• The AGT adapter no longer stamps appraisal.status: affirming on every record (#336), and both adapters check iat before signing (#343).
• The v0.3 draft schema refused neither a private cnf.jwk nor an RSA key with no key material (#372, #311).
• Input validation across content_marking, provenance, intent_bridge, revocation, the sandbox adapter and sign.verify_record() freshness bounds (#239, #282, #284, #287, #288, #290, #300, #305, #318, #322, #333, #334, #335, #339, #387, #410).
• The PyPI description named TrustRecord.sign(), record.anchor() and record.verify(), none of which exist. It now shows sign_record and verify_record (#309).

Full list in CHANGELOG.md.

Changelog

Sourced from agentrust-trace's changelog.

[0.11.0] - 2026-09-25

• Breaking: TraceSandboxAdapter and TraceAGTAdapter require enforcement_mode; it no longer defaults to "enforce". An evidence constructor that fills in "enforce" signs a claim that a policy was evaluated when nothing observed an evaluation (#416), and the first fix, a "declared" default (#417), is ruled out by spec section 4.3: declared MUST NOT be a default. Callers that omitted the argument now get a TypeError and must pass the mode their runtime actually ran under, or "declared" when no policy engine evaluated the policy. Runtime enforcement defaults are unchanged. Diagnosis and first fix by @​solloek369-arch.

• Signatures accept one spelling. sign._b64url_decode accepts only canonical unpadded base64url, so a Trust Record, JWK x, provenance, intent-bridge or revocation-bundle signature carrying padding or non-canonical trailing bits is refused instead of decoding to the same bytes. content_marking refuses served record bytes with duplicate members. Deeply nested cnf.jwk, tool calls and provenance records raise each module's documented error type instead of RecursionError, and tool_catalog_hash raises ProvenanceError for a catalog with no anchor form. ClusterFuzzLite now covers the record, bundle, provenance, bridge, content-marking and canonicalization paths (#418).

• Correct regulatory context in the published v0.1/v0.2 introductions and LIMITATIONS.md (#328, following #314). Separate Article 12 logging capability from TRACE tamper-evidence, identify Article 11 / Annex IV as documentation context, correct the applicability dates and remove unsupported TRACE-level compliance claims. Editorial only; reported by @​ioanavalea with review context from @​lywinged.

• Propose v0.3 MCP profile requirements for producer-defined attempts, signed full declaration snapshots and explicit retry outcomes (#324). Clarify existing session wording without changing v0.2 validation. Proposed by @​madeinplutofabio with declaration-binding refinements from @​Mayur021; maintainer-carried proposal, not adopted or implemented.

• Propose MCP Server Provenance v2 with normalized behavioral-hint binding (#406). Preserve v1 hashes and producer defaults; add explicit v2 production and consumer format requirements. Reported by @​altrudev.

• Compare challenge nonces as UTF-8 bytes so non-ASCII mismatches raise the documented ValueError instead of TypeError (#381). Matching strings remain accepted without Unicode normalization. Invalid non-string expected_nonce settings raise a clear ValueError. Reported by @​chernistry; follow-up review by @​lywinged.

• Report revocation bundles without an RFC 8785 form as unverified_for_revocation with cause bundle_malformed, while continuing record verification (#382). The direct bundle-digest API still refuses such input. Reported by @​chernistry.

• Regenerate the v0.3 draft after canonical reproducibility additions and make the schema inventory test use portable repository paths on Windows.

• Keep untrusted input on each verifier's documented error type. Nesting a few hundred levels deep in cnf.jwk, a tool call, a provenance record or served content-marking bytes raised RecursionError; a 4,400 digit URL port raised Python's integer-string ValueError; a float or unsafe integer in an offered tool's input_schema raised UnanchorableValue from check_tool_catalog. All were refusals already, none was an acceptance. Found by the new ClusterFuzzLite targets in .clusterfuzzlite/; regression tests in tests/test_untrusted_input_stays_on_the_documented_error.py.

• Decode signatures and JWK x as canonical unpadded base64url only. The decoder took the standard alphabet, = padding and stray characters, and ignored the unused bits of the last character, so one signature had several spellings that all verified, and a revocation bundle's bundle_digest (which covers sig.value) gave one bundle several identities. The record-level rule

... (truncated)

Commits

• 7d8df34 chore(release): agentrust-trace 0.11.0 (#420)
• 3d7c90f fix(adapters): require enforcement_mode in the AGT and sandbox adapters (supe...
• 5d9cf72 fix(security): strict signature decoding, documented refusals, ClusterFuzzLit...
• 9fd79b6 fix(provenance): allow an explicit verification instant (#411)
• 761783a docs(spec): name the instrument that set the Chapter III application dates (#...
• e3111c7 docs: separate regulatory logging duties from TRACE properties (#414)
• 9d303c5 docs: propose stateless MCP transcript profile requirements (#413)
• b217e60 fix(validation): share schema regex semantics across Python surfaces (#412)
• 0cbb72c fix(content-marking): require a textual profile identifier (#410)
• 7d3f8ac feat(provenance): bind behavioral hints in explicit v2 format (#409)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #321.