a2spa 2.4.1__tar.gz → 2.4.2__tar.gz

{a2spa-2.4.1/sdk/a2spa.egg-info → a2spa-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: a2spa
-Version: 2.4.1
+Version: 2.4.2
 Summary: A2SPA payload helper library for AI-agent runtime authorization
 Author: AI Modularity
 License-Expression: LicenseRef-Proprietary

{a2spa-2.4.1 → a2spa-2.4.2}/README.md

@@ -16,7 +16,7 @@ A2SPA does not prove target-side execution, commit, or exactly-once effects unle
 
 ## Hosted Service 2.4
 
-The hosted GA contract uses product and Python/npm package version `2.4.1`, protocol `v1.0`, and canonical `/v1` API routes. Existing `/api` runtime routes remain compatibility aliases during the documented migration window. The machine-readable API contract is published at `/A2SPA/openapi.json`.
+The hosted GA contract uses product and Python/npm package version `2.4.2`, protocol `v1.0`, and canonical `/v1` API routes. Existing `/api` runtime routes remain compatibility aliases during the documented migration window. The machine-readable API contract is published at `/A2SPA/openapi.json`.
 
 Enterprise/on-prem A2SPA is a separately sold product with its own release process and is not part of the hosted-service release contract.
 

{a2spa-2.4.1 → a2spa-2.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "a2spa"
-version = "2.4.1"
+version = "2.4.2"
 description = "A2SPA payload helper library for AI-agent runtime authorization"
 readme = "sdk/README.md"
 requires-python = ">=3.11,<3.13"

{a2spa-2.4.1 → a2spa-2.4.2/sdk/a2spa.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: a2spa
-Version: 2.4.1
+Version: 2.4.2
 Summary: A2SPA payload helper library for AI-agent runtime authorization
 Author: AI Modularity
 License-Expression: LicenseRef-Proprietary

{a2spa-2.4.1 → a2spa-2.4.2}/sdk/a2spa_evidence.py

@@ -168,6 +168,10 @@ def _resolve_receipt_trust(
     receipt_key_id = str(receipt.get("key_id") or "") if isinstance(receipt, dict) else ""
     if not key and isinstance(key_registry, dict) and receipt_key_id:
         registered = key_registry.get(receipt_key_id)
+        if isinstance(registered, dict) and (
+            registered.get("revoked") is True or registered.get("status") in {"revoked", "disabled"}
+        ):
+            return None, "trusted receipt key is revoked or disabled"
         key = registered.get("public_key_pem") if isinstance(registered, dict) else registered
 
     pins = _receipt_fingerprint_pins(external_policy)