ca2a-runtime 0.1.0a1__tar.gz → 0.2.0__tar.gz

ca2a_runtime-0.2.0/.dockerignore

@@ -0,0 +1,19 @@
+.git
+.github
+.venv
+.mypy_cache
+.pytest_cache
+.ruff_cache
+__pycache__
+*.py[cod]
+*.egg-info
+benchmarks
+docs
+examples
+experiments
+governance
+overrides
+scripts
+tests
+dist
+site

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -36,6 +36,11 @@ jobs:
       - name: Lint
         run: ruff check src/ tests/
 
+      # Checked, not applied. Without this gate 34 of 77 files drifted out of
+      # format unnoticed, because `ruff check` does not cover formatting.
+      - name: Format
+        run: ruff format --check src/ tests/
+
       - name: Type check
         run: mypy src/ca2a_runtime/ src/ca2a_verify/
 
@@ -54,12 +59,22 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
-      - name: Install dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" "agent-governance-toolkit[full]>=4.1"
+      - name: Install dependencies
+        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+
+      # AGT 4.1 currently constrains cryptography below 49, while the runtime
+      # requires 50+ for published security fixes. Keep the scanner isolated
+      # so its tooling constraints cannot downgrade the package under test,
+      # then override that stale upper bound inside the ephemeral scanner too.
+      - name: Install governance tooling in an isolated environment
+        run: |
+          python -m venv .agt-venv
+          .agt-venv/bin/pip install "agent-governance-toolkit[full]>=4.1"
+          .agt-venv/bin/pip install --upgrade --no-deps "cryptography>=50.0"
 
       - name: Generate evidence file
         run: python scripts/gen_agt_evidence.py
@@ -67,11 +82,11 @@ jobs:
       # Blocking gate: the [full] toolkit provides the ASI coverage modules
       # (10/10) and the evidence declares cA2A's governed capabilities, so strict
       # verify is COMPLETE. A regression that drops coverage or governance fails CI.
-      - name: AGT governance verify (strict)
-        run: agt verify --evidence agt-evidence.json
+      - name: AGT governance verify (strict)
+        run: .agt-venv/bin/agt verify --evidence agt-evidence.json
 
-      - name: Save attestation JSON
-        run: agt --json verify --evidence agt-evidence.json > agt-attestation.json
+      - name: Save attestation JSON
+        run: .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json
 
       - name: Upload governance artifacts
         uses: actions/upload-artifact@v7
@@ -90,7 +105,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/codeql.yml

@@ -28,16 +28,16 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.6
         with:
           languages: python
           queries: +security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v4.37.6
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.6
         continue-on-error: true
         with:
           category: /language:python

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/contributor-check.yml

@@ -30,7 +30,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: agentrust-io/.github
-          ref: main
+          # Pinned deliberately: this workflow runs on pull_request_target
+          # with a write-capable token, so the code it checks out must not
+          # track a mutable ref. Bump this SHA after reviewing the diff.
+          ref: 0fe4520ee71a743fcd33f409fe366ee3e1da6f86 # main as of 2026-08-01
           persist-credentials: false
           sparse-checkout: |
             scripts

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/docker.yml

@@ -4,12 +4,37 @@ on:
   push:
     tags:
       - "v*"
+  pull_request:
+    paths:
+      - "Dockerfile"
+      - ".dockerignore"
+      - "pyproject.toml"
+      - "src/**"
+      - ".github/workflows/docker.yml"
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
+  build-pr:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Build image without publishing
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          push: false
+          tags: ghcr.io/agentrust-io/ca2a-runtime:${{ github.sha }}
+
   build-and-push:
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -19,10 +44,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -34,7 +59,7 @@ jobs:
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           push: true
@@ -43,7 +68,7 @@ jobs:
             ghcr.io/agentrust-io/ca2a-runtime:latest
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3
 
       - name: Sign the image (keyless, by digest)
         env:
@@ -51,7 +76,7 @@ jobs:
         run: cosign sign --yes ghcr.io/agentrust-io/ca2a-runtime@${DIGEST}
 
       - name: Attest build provenance (SLSA)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@8beda2b7ed98355c0e97c0a63bec38ae472e66c4 # v4
         with:
           subject-name: ghcr.io/agentrust-io/ca2a-runtime
           subject-digest: ${{ steps.build.outputs.digest }}

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/docs.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: pip

ca2a_runtime-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,106 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install release tooling
+        run: python -m pip install build twine
+
+      - name: Verify release tag matches package version
+        run: |
+          package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          test "${GITHUB_REF_NAME}" = "v${package_version}"
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Check distribution metadata
+        run: python -m twine check dist/*
+
+      - name: Install and smoke-test wheel
+        run: |
+          python -m venv /tmp/ca2a-wheel
+          /tmp/ca2a-wheel/bin/python -m pip install dist/*.whl
+          /tmp/ca2a-wheel/bin/python -c 'import importlib.metadata, ca2a_runtime; expected="${{ github.ref_name }}"[1:]; assert importlib.metadata.version("ca2a-runtime") == expected; assert ca2a_runtime.__version__ == expected'
+          /tmp/ca2a-wheel/bin/ca2a --help
+
+      - name: Install and smoke-test source distribution
+        run: |
+          python -m venv /tmp/ca2a-sdist
+          /tmp/ca2a-sdist/bin/python -m pip install dist/*.tar.gz
+          /tmp/ca2a-sdist/bin/python -c 'import importlib.metadata, ca2a_runtime; expected="${{ github.ref_name }}"[1:]; assert importlib.metadata.version("ca2a-runtime") == expected; assert ca2a_runtime.__version__ == expected'
+          /tmp/ca2a-sdist/bin/ca2a --help
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # OIDC trusted publishing, no API tokens
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+
+  governance-release:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # upload release assets
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install package
+        run: python -m pip install --upgrade pip && pip install -e "."
+
+      # Isolate AGT's tooling dependencies from the release artifact. AGT 4.1
+      # constrains cryptography below 49; cA2A requires 50+ security fixes. The
+      # ephemeral scanner is upgraded too so the release gate runs no known-
+      # vulnerable cryptography build while that upstream bound is stale.
+      - name: Install governance tooling in an isolated environment
+        run: |
+          python -m venv .agt-venv
+          .agt-venv/bin/pip install "agent-governance-toolkit[full]>=4.1"
+          .agt-venv/bin/pip install --upgrade --no-deps "cryptography>=50.0"
+
+      - name: Generate evidence file
+        run: python scripts/gen_agt_evidence.py
+
+      - name: AGT governance verify (strict)
+        run: .agt-venv/bin/agt verify --evidence agt-evidence.json
+
+      - name: Save attestation JSON
+        run: .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json
+
+      - name: Attach evidence to release
+        if: github.event_name == 'release'
+        run: gh release upload ${{ github.ref_name }} agt-evidence.json agt-attestation.json
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/require-maintainer-approval.yml

@@ -25,7 +25,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const MAINTAINERS = ['imran-siddique'];
+            const MAINTAINERS = ['imran-siddique', 'pforest', 'podcastinator', 'carloshvp', 'Qiang-Xu', 'zohebk8s'];
 
             const author = context.payload.pull_request.user.login;
             if (MAINTAINERS.includes(author)) {
@@ -33,12 +33,6 @@ jobs:
               return;
             }
 
-            const association = context.payload.pull_request.author_association;
-            if (association === 'MEMBER' || association === 'OWNER') {
-              core.info(`Author is ${association}, skipping gate`);
-              return;
-            }
-
             // Both pull_request_target and pull_request_review payloads
             // carry the PR at context.payload.pull_request.
             const prNumber = context.payload.pull_request.number;

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.github/workflows/scorecard.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
@@ -38,6 +38,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.6
         with:
           sarif_file: scorecard-results.sarif

{ca2a_runtime-0.1.0a1 → ca2a_runtime-0.2.0}/.gitignore

@@ -31,3 +31,6 @@ agt-evidence.json
 agt-attestation.json
 sbom.spdx.json
 scorecard-results.sarif
+
+# Generated example output (ephemeral keys + timestamps)
+examples/trace-dag/dag.json

ca2a_runtime-0.2.0/ADOPTERS.md

@@ -0,0 +1,7 @@
+# Adopters
+
+Organizations using cA2A in production or evaluation are listed here.
+
+To add yours, open a PR adding a line with your organization, the use case, and the month you started. Anything you are not able to say publicly, leave out; a one-line entry is worth more than a case study you have to get approved.
+
+cA2A is available as a Developer Preview, so evaluations are especially useful even when they do not become entries here: open a [Discussion](https://github.com/orgs/agentrust-io/discussions) or contact the maintainers listed in [MAINTAINERS.md](MAINTAINERS.md).