ca2a-runtime 0.2.0__tar.gz → 0.3.1__tar.gz

ca2a_runtime-0.3.1/.clusterfuzzlite/Dockerfile

@@ -0,0 +1,5 @@
+FROM gcr.io/oss-fuzz-base/base-builder-python
+
+COPY . $SRC/ca2a
+COPY .clusterfuzzlite/build.sh $SRC/build.sh
+WORKDIR $SRC/ca2a

ca2a_runtime-0.3.1/.clusterfuzzlite/README.md

@@ -0,0 +1,60 @@
+# Fuzzing
+
+Coverage-guided fuzzing via [ClusterFuzzLite](https://google.github.io/clusterfuzzlite/),
+running Atheris against the input cA2A reads before it has decided to trust the
+party that sent it. Mirrors the setup in agentrust-io/agent-manifest and
+agentrust-io/cmcp.
+
+## What is fuzzed
+
+| Target | Surface |
+| --- | --- |
+| `fuzz_wire_documents.py` | JSON from outside: the A2A request `PeerNode.handle` serves (delegation chain, holder proof, caller offer, sealed payload), the authenticated-response envelope, a revocation snapshot, and the chain and TRACE DAG documents the offline verifier loads. |
+| `fuzz_attestation_parsers.py` | TDX quote, SEV-SNP report, TPM quote and TPMT_SIGNATURE parsing, plus `verify_challenge` over caller-supplied challenge text. |
+| `fuzz_canonical_json.py` | The RFC 8785 bytes every credential, holder proof, revocation statement and response MAC is computed over. |
+
+## The properties
+
+The wire and parser targets assert that each surface fails closed: it returns,
+or raises the error family it documents (`CA2AError`, and `AttestationFailed`
+for evidence). A `TypeError`, `struct.error`, `AttributeError` or
+`RecursionError` escaping means a caller written against the documented
+exception will not catch it, and on the reference server the connection drops
+with no response.
+
+`fuzz_canonical_json.py` asserts a round trip: parsing the canonical output must
+reproduce the input exactly, and integers outside +/-(2**53 - 1) must be
+refused. cA2A's data model has no floats, so the comparison is exact.
+
+## Standing when added
+
+A local plain-Python run of each `TestOneInput` (Atheris does not install on the
+Windows machine it was written on) found three escapes that are fixed in the
+same change, with regression tests: `TdxQuote.parse` raising `struct.error` on a
+quote whose signature section is shorter than its declared contents,
+`verify_challenge` raising `TypeError` on a non-ASCII MAC, and
+`DelegationCredential.from_dict` raising `TypeError` on a hop that is not an
+object.
+
+## Bundling gotcha
+
+`compile_python_fuzzer` bundles each target with PyInstaller, which follows
+static imports only and bundles code, not package data. `build.sh` passes
+`--collect-submodules=email` for the lazy `email.mime` import in the
+cryptography and pydantic stacks, and `--collect-data` for `agentrust_trace`,
+whose TRACE schema `ca2a_verify.dag` loads at import time.
+
+## Running locally
+
+```
+git clone https://github.com/google/clusterfuzzlite --depth 1 /tmp/clusterfuzzlite
+python /tmp/clusterfuzzlite/infra/helper.py build_image --external $PWD
+python /tmp/clusterfuzzlite/infra/helper.py build_fuzzers --external --sanitizer address $PWD
+python /tmp/clusterfuzzlite/infra/helper.py run_fuzzer --external $PWD fuzz_wire_documents
+```
+
+## In CI
+
+`cflite_pr.yml` fuzzes code the pull request touched, for five minutes.
+`cflite_batch.yml` runs every target for thirty minutes, nightly. Both are
+read-only and time out at 45 minutes; the oss-fuzz base image build dominates.

ca2a_runtime-0.3.1/.clusterfuzzlite/build.sh

@@ -0,0 +1,29 @@
+#!/bin/bash -eu
+# Build the fuzz targets for ClusterFuzzLite.
+#
+# Installed rather than put on the path so the targets exercise the same import
+# surface a consumer gets. Third-party dependencies come from the same
+# hash-pinned locks the container image uses, and the package goes in with
+# --no-deps and without build isolation, so nothing here resolves unpinned.
+
+cd "$SRC/ca2a"
+pip3 install --no-cache-dir --require-hashes -r requirements/build.txt
+pip3 install --no-cache-dir --require-hashes -r requirements/runtime.txt
+pip3 install --no-cache-dir --no-deps --no-build-isolation .
+
+# compile_python_fuzzer bundles each target with PyInstaller, which follows
+# static imports only and bundles code, not package data.
+PYI_ARGS=(
+  # The cryptography and pydantic stacks reach email.mime lazily; without this
+  # the bundled target dies with ModuleNotFoundError, which libFuzzer reports
+  # as a crash in the target.
+  --collect-submodules=email
+  # ca2a_verify.dag validates records against the TRACE JSON schema, which
+  # agentrust_trace loads from inside its package at import time.
+  --collect-data=agentrust_trace
+  --collect-data=agent_manifest
+)
+
+for target in "$SRC"/ca2a/.clusterfuzzlite/fuzz_*.py; do
+  compile_python_fuzzer "$target" "${PYI_ARGS[@]}"
+done

ca2a_runtime-0.3.1/.clusterfuzzlite/fuzz_attestation_parsers.py

@@ -0,0 +1,62 @@
+#!/usr/bin/python3
+"""Fuzz the attestation evidence parsers.
+
+A callee reads a caller's evidence (``raw_evidence`` in a ``caller_offer``)
+before deciding to trust anything about it, and an auditor feeds recorded
+quotes to ``ca2a_verify`` offline. These parsers read that binary at fixed
+offsets under declared lengths the blob itself supplies: a TDX quote with four
+nested size fields, an SNP report, a TPM quote and a TPMT_SIGNATURE.
+
+The property is that each fails closed: it returns, or raises
+AttestationFailed, the error the verifier documents. A struct.error, IndexError
+or OverflowError reaching the caller means a declared length was believed. That
+is the bug this target was written against: TdxQuote.parse used to raise
+struct.error on a quote whose signature section was shorter than it claimed.
+
+The challenge verifier is included because its input, the offer nonce and the
+holder proof's challenge, is caller text read before anything authenticates it.
+"""
+
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from ca2a_runtime.challenge import verify_challenge
+    from ca2a_runtime.errors import AttestationFailed
+    from ca2a_runtime.tee.sev_snp import SevSnpReport
+    from ca2a_runtime.tee.tdx import TdxQuote
+    from ca2a_runtime.tee.tpm import TpmQuote
+    from ca2a_verify.tpm import parse_tpmt_signature
+
+_SECRET = b"\x00" * 32
+
+_PARSERS = [
+    TdxQuote.parse,
+    SevSnpReport.parse,
+    TpmQuote.parse,
+    parse_tpmt_signature,
+]
+
+
+def TestOneInput(data: bytes) -> None:
+    if not data:
+        return
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, len(_PARSERS))
+    try:
+        if choice == len(_PARSERS):
+            verify_challenge(_SECRET, fdp.ConsumeUnicode(fdp.remaining_bytes()))
+        else:
+            _PARSERS[choice](fdp.ConsumeBytes(fdp.remaining_bytes()))
+    except AttestationFailed:
+        pass
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.3.1/.clusterfuzzlite/fuzz_canonical_json.py

@@ -0,0 +1,89 @@
+#!/usr/bin/python3
+"""Fuzz the RFC 8785 canonicalizer for the invariant its signatures depend on.
+
+canonicalize() produces the bytes every delegation credential, holder proof,
+revocation statement and response MAC is computed over, so the bytes must be a
+faithful, lossless encoding of the input. The property asserted is a round trip:
+parsing the canonical output back must reproduce the input exactly.
+
+A crash-only check would pass over the bugs that matter here. The ones found in
+sibling canonicalizers were silent: two distinct keys serialized as one key
+twice, a parser kept one of the pair, and a field vanished from a document whose
+signature claimed to cover it.
+
+Structure is built from the fuzz data rather than by mutating JSON text, so the
+budget goes on key and value shapes (combining marks, surrogate pairs, control
+characters, integers straddling 2**53) rather than on producing valid JSON.
+"""
+
+import json
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from ca2a_runtime.canonical import canonicalize
+
+_MAX_DEPTH = 4
+_MAX_ITEMS = 6
+_SAFE = 2**53 - 1
+
+
+def _build(fdp, depth=0):
+    if depth >= _MAX_DEPTH or fdp.remaining_bytes() == 0:
+        return fdp.ConsumeUnicodeNoSurrogates(16)
+    kind = fdp.ConsumeIntInRange(0, 6)
+    if kind == 0:
+        return None
+    if kind == 1:
+        return fdp.ConsumeBool()
+    if kind == 2:
+        # Straddle the safe-integer boundary: outside it canonicalize() must
+        # refuse rather than emit digits a conforming verifier would not.
+        return fdp.ConsumeIntInRange(-(2**54), 2**54)
+    if kind == 3:
+        return fdp.ConsumeUnicodeNoSurrogates(64)
+    if kind == 4:
+        return [_build(fdp, depth + 1) for _ in range(fdp.ConsumeIntInRange(0, _MAX_ITEMS))]
+    return {
+        fdp.ConsumeUnicodeNoSurrogates(24): _build(fdp, depth + 1)
+        for _ in range(fdp.ConsumeIntInRange(0, _MAX_ITEMS))
+    }
+
+
+def _has_unsafe_int(value):
+    if isinstance(value, bool):
+        return False
+    if isinstance(value, int):
+        return not -_SAFE <= value <= _SAFE
+    if isinstance(value, dict):
+        return any(_has_unsafe_int(v) for v in value.values())
+    if isinstance(value, list):
+        return any(_has_unsafe_int(v) for v in value)
+    return False
+
+
+def TestOneInput(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    value = _build(fdp)
+    try:
+        out = canonicalize(value)
+    except ValueError:
+        # Declared: integers outside the RFC 8785 safe domain, and only those.
+        assert _has_unsafe_int(value), "canonicalize() refused an in-domain value"
+        return
+    assert not _has_unsafe_int(value), "an out-of-domain integer was serialized"
+
+    # cA2A's data model has no floats, so every number re-parses as the int it
+    # was and the round trip can be asserted exactly, bools included.
+    assert json.loads(out) == value, f"canonical bytes did not round-trip: {out!r}"
+    assert canonicalize(json.loads(out)) == out, "canonical form is not a fixed point"
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.3.1/.clusterfuzzlite/fuzz_wire_documents.py

@@ -0,0 +1,92 @@
+#!/usr/bin/python3
+"""Fuzz the JSON documents cA2A accepts from outside.
+
+Each surface takes arbitrary JSON from a party that has not been authenticated
+yet, and each documents one error family for anything malformed:
+
+- the A2A request a callee serves (``PeerNode.handle``), which parses the
+  delegation chain, holder proof, caller offer and sealed payload, then runs
+  the inbound pipeline up to the first refusal: CA2AError;
+- the authenticated-response envelope (``response.decode``):
+  ResponseAuthenticationFailed, a CA2AError;
+- a revocation snapshot (``RevocationSnapshot.from_dict``): InvalidRevocation;
+- a delegation chain document and a TRACE DAG handed to the offline verifier:
+  CA2AError.
+
+Anything else escaping (TypeError, AttributeError, KeyError, UnicodeError,
+RecursionError) is a crash: on the live path it drops the connection with no
+response, and offline it escapes the verifier's contract. The input is decoded
+the way the reference server decodes a body, so what reaches the parsers is
+exactly what the wire can deliver.
+"""
+
+import contextlib
+import json
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+    from ca2a_runtime import response
+    from ca2a_runtime.delegation import RevocationSnapshot
+    from ca2a_runtime.errors import CA2AError
+    from ca2a_runtime.node import PeerNode
+    from ca2a_runtime.policy import LocalPolicy
+    from ca2a_verify.dag import verify_trace_dag
+    from ca2a_verify.verify import _parse_chain, verify_delegation_chain
+
+_ROOT = Ed25519PrivateKey.from_private_bytes(b"\x01" * 32).public_key().public_bytes_raw().hex()
+_NODE = PeerNode(LocalPolicy.of(["read", "write"]), trusted_root_issuers={_ROOT})
+
+
+def _handle(doc):
+    if isinstance(doc, dict):
+        _NODE.handle(doc)
+
+
+def _revocations(doc):
+    RevocationSnapshot.from_dict(doc)
+
+
+def _chain(doc):
+    verify_delegation_chain(_parse_chain(doc), trusted_root_issuers={_ROOT})
+
+
+def _dag(doc):
+    if isinstance(doc, dict):
+        doc = doc.get("records", doc)
+    if isinstance(doc, list) and doc:
+        verify_trace_dag(doc, trusted_keys=[])
+
+
+_JSON_TARGETS = [_handle, _revocations, _chain, _dag]
+
+
+def TestOneInput(data: bytes) -> None:
+    if not data:
+        return
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, len(_JSON_TARGETS))
+    raw = fdp.ConsumeBytes(fdp.remaining_bytes())
+    if choice == len(_JSON_TARGETS):
+        with contextlib.suppress(CA2AError):
+            response.decode(raw)
+        return
+    try:
+        doc = json.loads(raw)
+    except (ValueError, RecursionError):
+        # The reference server answers 400 before any parser runs.
+        return
+    with contextlib.suppress(CA2AError):
+        _JSON_TARGETS[choice](doc)
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

{ca2a_runtime-0.2.0 → ca2a_runtime-0.3.1}/.github/CODEOWNERS

@@ -1,14 +1,14 @@
 # Default owners for all files
-* @agentrust-io/maintainers
+* @agentrust-io/maintainers @carloshvp @zohebk8s
 
 # Security-sensitive paths require security-reviewers sign-off
-src/ca2a_runtime/delegation/ @agentrust-io/security-reviewers @agentrust-io/maintainers
-src/ca2a_runtime/channel/ @agentrust-io/security-reviewers @agentrust-io/maintainers
-src/ca2a_runtime/tee/ @agentrust-io/security-reviewers @agentrust-io/maintainers
-src/ca2a_verify/ @agentrust-io/security-reviewers @agentrust-io/maintainers
+src/ca2a_runtime/delegation/ @agentrust-io/security-reviewers @agentrust-io/maintainers @carloshvp @zohebk8s
+src/ca2a_runtime/channel/ @agentrust-io/security-reviewers @agentrust-io/maintainers @carloshvp @zohebk8s
+src/ca2a_runtime/tee/ @agentrust-io/security-reviewers @agentrust-io/maintainers @carloshvp @zohebk8s
+src/ca2a_verify/ @agentrust-io/security-reviewers @agentrust-io/maintainers @carloshvp @zohebk8s
 
 # CI/CD workflow changes
-.github/workflows/ @agentrust-io/maintainers
+.github/workflows/ @agentrust-io/maintainers @carloshvp @zohebk8s
 
 # Package configuration
-pyproject.toml @agentrust-io/maintainers
+pyproject.toml @agentrust-io/maintainers @carloshvp @zohebk8s

ca2a_runtime-0.3.1/.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
+
+  # Refreshes the digest the Dockerfile pins its base image to. Without this the
+  # pin would hold the image at whatever it was on the day it was written.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    # Digest refreshes and 3.11 patch releases only. Moving the image to a new
+    # Python minor is a deliberate change with its own PR and test run.
+    ignore:
+      - dependency-name: "python"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"

ca2a_runtime-0.3.1/.github/workflows/actionlint.yml

@@ -0,0 +1,41 @@
+name: Workflow lint
+
+# actionlint catches what a YAML parser cannot: duplicate mapping keys that
+# make GitHub refuse to load a workflow, invalid ${{ }} expressions, and shell
+# problems inside run: blocks. A duplicate env: key silently broke this repo
+# family's release workflow once; yaml.safe_load keeps the last value without
+# complaining, so local validation passed while Actions rejected the file.
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Fetched and checksum-verified rather than run as a third-party action,
+      # so this check adds no new action to the supply chain it exists to guard.
+      - name: Install actionlint
+        env:
+          ACTIONLINT_VERSION: 1.7.12
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          set -euo pipefail
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl -sSfL -o "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" actionlint
+          install -m 0755 actionlint /usr/local/bin/actionlint
+
+      - name: Lint workflows
+        run: actionlint -color

ca2a_runtime-0.3.1/.github/workflows/cflite_batch.yml

@@ -0,0 +1,36 @@
+name: ClusterFuzzLite batch
+
+on:
+  schedule:
+    # 04:40 UTC daily, off the hour and off agent-manifest's 04:20 slot.
+    - cron: '40 4 * * *'
+  workflow_dispatch:
+
+permissions: read-all
+
+concurrency:
+  group: cflite-batch
+  cancel-in-progress: false
+
+jobs:
+  fuzz:
+    name: Batch fuzz
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Build fuzzers
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          # Every target, not just what changed. Thirty minutes of fuzzing
+          # leaves room for the base image build inside the 45 minute timeout.
+          fuzz-seconds: 1800
+          mode: batch
+          sanitizer: address

ca2a_runtime-0.3.1/.github/workflows/cflite_pr.yml

@@ -0,0 +1,43 @@
+name: ClusterFuzzLite PR
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'requirements/build.txt'
+      - 'requirements/runtime.txt'
+      - '.clusterfuzzlite/**'
+      - '.github/workflows/cflite_pr.yml'
+
+# Read-only. Findings surface in the job log and the uploaded crash artifact
+# rather than as code-scanning alerts, so no security-events: write is needed.
+permissions: read-all
+
+concurrency:
+  group: cflite-pr-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz changed code
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # Only the address sanitizer. The targets are pure Python under Atheris,
+      # where undefined-behaviour instrumentation has nothing to instrument.
+      - name: Build fuzzers
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 300
+          # code-change fuzzes only what the PR touched, which is what keeps
+          # this inside a PR's time budget. The nightly batch covers the rest.
+          mode: code-change
+          sanitizer: address

{ca2a_runtime-0.2.0 → ca2a_runtime-0.3.1}/.github/workflows/ci.yml

@@ -12,8 +12,13 @@ on:
         required: false
         default: ""
 
+permissions:
+  contents: read
 jobs:
   test:
+    permissions:
+      contents: read
+      id-token: write  # Authenticate coverage uploads with GitHub OIDC.
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -21,17 +26,26 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: python -m pip install --require-hashes -r requirements/dev.txt
+
+      - name: Install local package
+        run: python -m pip install --no-deps -e .
 
       - name: Security scan
-        run: pip install bandit pip-audit && bandit -r src/ -c pyproject.toml && pip-audit
+        # bandit and pip-audit are already in the dev extra above, so the
+        # scan runs against the same pinned versions rather than fetching
+        # whatever is current at scan time.
+        run: bandit -r src/ -c pyproject.toml && pip-audit
 
       - name: Lint
         run: ruff check src/ tests/
@@ -48,23 +62,31 @@ jobs:
         run: pytest tests/unit/ tests/conformance/ -v --tb=short --cov=src --cov-report=xml
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
-          fail_ci_if_error: false
+          use_oidc: true
+          files: coverage.xml
+          fail_ci_if_error: true
 
   governance:
     runs-on: ubuntu-latest
     needs: test
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: python -m pip install --require-hashes -r requirements/dev.txt
+
+      - name: Install local package
+        run: python -m pip install --no-deps -e .
 
       # AGT 4.1 currently constrains cryptography below 49, while the runtime
       # requires 50+ for published security fixes. Keep the scanner isolated
@@ -73,8 +95,10 @@ jobs:
       - name: Install governance tooling in an isolated environment
         run: |
           python -m venv .agt-venv
-          .agt-venv/bin/pip install "agent-governance-toolkit[full]>=4.1"
-          .agt-venv/bin/pip install --upgrade --no-deps "cryptography>=50.0"
+          # --no-deps because the lock already lists every transitive
+          # dependency, and pip would otherwise re-resolve and reject the
+          # cryptography override the compile deliberately applied.
+          .agt-venv/bin/pip install --require-hashes --no-deps -r requirements/agt.txt
 
       - name: Generate evidence file
         run: python scripts/gen_agt_evidence.py
@@ -89,7 +113,7 @@ jobs:
         run: .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json
 
       - name: Upload governance artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
         with:
           name: agt-governance-${{ github.sha }}
           path: |
@@ -103,20 +127,26 @@ jobs:
     if: github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: python -m pip install --require-hashes -r requirements/dev.txt
+
+      - name: Install local package
+        run: python -m pip install --no-deps -e .
 
       - name: Run benchmark (software-only, CI gate p99 < 5ms)
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
         with:
           name: benchmark-results
           path: benchmarks/