ca2a-runtime 0.3.0__tar.gz → 0.3.1__tar.gz

ca2a_runtime-0.3.1/.clusterfuzzlite/Dockerfile

@@ -0,0 +1,5 @@
+FROM gcr.io/oss-fuzz-base/base-builder-python
+
+COPY . $SRC/ca2a
+COPY .clusterfuzzlite/build.sh $SRC/build.sh
+WORKDIR $SRC/ca2a

ca2a_runtime-0.3.1/.clusterfuzzlite/README.md

@@ -0,0 +1,60 @@
+# Fuzzing
+
+Coverage-guided fuzzing via [ClusterFuzzLite](https://google.github.io/clusterfuzzlite/),
+running Atheris against the input cA2A reads before it has decided to trust the
+party that sent it. Mirrors the setup in agentrust-io/agent-manifest and
+agentrust-io/cmcp.
+
+## What is fuzzed
+
+| Target | Surface |
+| --- | --- |
+| `fuzz_wire_documents.py` | JSON from outside: the A2A request `PeerNode.handle` serves (delegation chain, holder proof, caller offer, sealed payload), the authenticated-response envelope, a revocation snapshot, and the chain and TRACE DAG documents the offline verifier loads. |
+| `fuzz_attestation_parsers.py` | TDX quote, SEV-SNP report, TPM quote and TPMT_SIGNATURE parsing, plus `verify_challenge` over caller-supplied challenge text. |
+| `fuzz_canonical_json.py` | The RFC 8785 bytes every credential, holder proof, revocation statement and response MAC is computed over. |
+
+## The properties
+
+The wire and parser targets assert that each surface fails closed: it returns,
+or raises the error family it documents (`CA2AError`, and `AttestationFailed`
+for evidence). A `TypeError`, `struct.error`, `AttributeError` or
+`RecursionError` escaping means a caller written against the documented
+exception will not catch it, and on the reference server the connection drops
+with no response.
+
+`fuzz_canonical_json.py` asserts a round trip: parsing the canonical output must
+reproduce the input exactly, and integers outside +/-(2**53 - 1) must be
+refused. cA2A's data model has no floats, so the comparison is exact.
+
+## Standing when added
+
+A local plain-Python run of each `TestOneInput` (Atheris does not install on the
+Windows machine it was written on) found three escapes that are fixed in the
+same change, with regression tests: `TdxQuote.parse` raising `struct.error` on a
+quote whose signature section is shorter than its declared contents,
+`verify_challenge` raising `TypeError` on a non-ASCII MAC, and
+`DelegationCredential.from_dict` raising `TypeError` on a hop that is not an
+object.
+
+## Bundling gotcha
+
+`compile_python_fuzzer` bundles each target with PyInstaller, which follows
+static imports only and bundles code, not package data. `build.sh` passes
+`--collect-submodules=email` for the lazy `email.mime` import in the
+cryptography and pydantic stacks, and `--collect-data` for `agentrust_trace`,
+whose TRACE schema `ca2a_verify.dag` loads at import time.
+
+## Running locally
+
+```
+git clone https://github.com/google/clusterfuzzlite --depth 1 /tmp/clusterfuzzlite
+python /tmp/clusterfuzzlite/infra/helper.py build_image --external $PWD
+python /tmp/clusterfuzzlite/infra/helper.py build_fuzzers --external --sanitizer address $PWD
+python /tmp/clusterfuzzlite/infra/helper.py run_fuzzer --external $PWD fuzz_wire_documents
+```
+
+## In CI
+
+`cflite_pr.yml` fuzzes code the pull request touched, for five minutes.
+`cflite_batch.yml` runs every target for thirty minutes, nightly. Both are
+read-only and time out at 45 minutes; the oss-fuzz base image build dominates.

ca2a_runtime-0.3.1/.clusterfuzzlite/build.sh

@@ -0,0 +1,29 @@
+#!/bin/bash -eu
+# Build the fuzz targets for ClusterFuzzLite.
+#
+# Installed rather than put on the path so the targets exercise the same import
+# surface a consumer gets. Third-party dependencies come from the same
+# hash-pinned locks the container image uses, and the package goes in with
+# --no-deps and without build isolation, so nothing here resolves unpinned.
+
+cd "$SRC/ca2a"
+pip3 install --no-cache-dir --require-hashes -r requirements/build.txt
+pip3 install --no-cache-dir --require-hashes -r requirements/runtime.txt
+pip3 install --no-cache-dir --no-deps --no-build-isolation .
+
+# compile_python_fuzzer bundles each target with PyInstaller, which follows
+# static imports only and bundles code, not package data.
+PYI_ARGS=(
+  # The cryptography and pydantic stacks reach email.mime lazily; without this
+  # the bundled target dies with ModuleNotFoundError, which libFuzzer reports
+  # as a crash in the target.
+  --collect-submodules=email
+  # ca2a_verify.dag validates records against the TRACE JSON schema, which
+  # agentrust_trace loads from inside its package at import time.
+  --collect-data=agentrust_trace
+  --collect-data=agent_manifest
+)
+
+for target in "$SRC"/ca2a/.clusterfuzzlite/fuzz_*.py; do
+  compile_python_fuzzer "$target" "${PYI_ARGS[@]}"
+done

ca2a_runtime-0.3.1/.clusterfuzzlite/fuzz_attestation_parsers.py

@@ -0,0 +1,62 @@
+#!/usr/bin/python3
+"""Fuzz the attestation evidence parsers.
+
+A callee reads a caller's evidence (``raw_evidence`` in a ``caller_offer``)
+before deciding to trust anything about it, and an auditor feeds recorded
+quotes to ``ca2a_verify`` offline. These parsers read that binary at fixed
+offsets under declared lengths the blob itself supplies: a TDX quote with four
+nested size fields, an SNP report, a TPM quote and a TPMT_SIGNATURE.
+
+The property is that each fails closed: it returns, or raises
+AttestationFailed, the error the verifier documents. A struct.error, IndexError
+or OverflowError reaching the caller means a declared length was believed. That
+is the bug this target was written against: TdxQuote.parse used to raise
+struct.error on a quote whose signature section was shorter than it claimed.
+
+The challenge verifier is included because its input, the offer nonce and the
+holder proof's challenge, is caller text read before anything authenticates it.
+"""
+
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from ca2a_runtime.challenge import verify_challenge
+    from ca2a_runtime.errors import AttestationFailed
+    from ca2a_runtime.tee.sev_snp import SevSnpReport
+    from ca2a_runtime.tee.tdx import TdxQuote
+    from ca2a_runtime.tee.tpm import TpmQuote
+    from ca2a_verify.tpm import parse_tpmt_signature
+
+_SECRET = b"\x00" * 32
+
+_PARSERS = [
+    TdxQuote.parse,
+    SevSnpReport.parse,
+    TpmQuote.parse,
+    parse_tpmt_signature,
+]
+
+
+def TestOneInput(data: bytes) -> None:
+    if not data:
+        return
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, len(_PARSERS))
+    try:
+        if choice == len(_PARSERS):
+            verify_challenge(_SECRET, fdp.ConsumeUnicode(fdp.remaining_bytes()))
+        else:
+            _PARSERS[choice](fdp.ConsumeBytes(fdp.remaining_bytes()))
+    except AttestationFailed:
+        pass
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.3.1/.clusterfuzzlite/fuzz_canonical_json.py

@@ -0,0 +1,89 @@
+#!/usr/bin/python3
+"""Fuzz the RFC 8785 canonicalizer for the invariant its signatures depend on.
+
+canonicalize() produces the bytes every delegation credential, holder proof,
+revocation statement and response MAC is computed over, so the bytes must be a
+faithful, lossless encoding of the input. The property asserted is a round trip:
+parsing the canonical output back must reproduce the input exactly.
+
+A crash-only check would pass over the bugs that matter here. The ones found in
+sibling canonicalizers were silent: two distinct keys serialized as one key
+twice, a parser kept one of the pair, and a field vanished from a document whose
+signature claimed to cover it.
+
+Structure is built from the fuzz data rather than by mutating JSON text, so the
+budget goes on key and value shapes (combining marks, surrogate pairs, control
+characters, integers straddling 2**53) rather than on producing valid JSON.
+"""
+
+import json
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from ca2a_runtime.canonical import canonicalize
+
+_MAX_DEPTH = 4
+_MAX_ITEMS = 6
+_SAFE = 2**53 - 1
+
+
+def _build(fdp, depth=0):
+    if depth >= _MAX_DEPTH or fdp.remaining_bytes() == 0:
+        return fdp.ConsumeUnicodeNoSurrogates(16)
+    kind = fdp.ConsumeIntInRange(0, 6)
+    if kind == 0:
+        return None
+    if kind == 1:
+        return fdp.ConsumeBool()
+    if kind == 2:
+        # Straddle the safe-integer boundary: outside it canonicalize() must
+        # refuse rather than emit digits a conforming verifier would not.
+        return fdp.ConsumeIntInRange(-(2**54), 2**54)
+    if kind == 3:
+        return fdp.ConsumeUnicodeNoSurrogates(64)
+    if kind == 4:
+        return [_build(fdp, depth + 1) for _ in range(fdp.ConsumeIntInRange(0, _MAX_ITEMS))]
+    return {
+        fdp.ConsumeUnicodeNoSurrogates(24): _build(fdp, depth + 1)
+        for _ in range(fdp.ConsumeIntInRange(0, _MAX_ITEMS))
+    }
+
+
+def _has_unsafe_int(value):
+    if isinstance(value, bool):
+        return False
+    if isinstance(value, int):
+        return not -_SAFE <= value <= _SAFE
+    if isinstance(value, dict):
+        return any(_has_unsafe_int(v) for v in value.values())
+    if isinstance(value, list):
+        return any(_has_unsafe_int(v) for v in value)
+    return False
+
+
+def TestOneInput(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    value = _build(fdp)
+    try:
+        out = canonicalize(value)
+    except ValueError:
+        # Declared: integers outside the RFC 8785 safe domain, and only those.
+        assert _has_unsafe_int(value), "canonicalize() refused an in-domain value"
+        return
+    assert not _has_unsafe_int(value), "an out-of-domain integer was serialized"
+
+    # cA2A's data model has no floats, so every number re-parses as the int it
+    # was and the round trip can be asserted exactly, bools included.
+    assert json.loads(out) == value, f"canonical bytes did not round-trip: {out!r}"
+    assert canonicalize(json.loads(out)) == out, "canonical form is not a fixed point"
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.3.1/.clusterfuzzlite/fuzz_wire_documents.py

@@ -0,0 +1,92 @@
+#!/usr/bin/python3
+"""Fuzz the JSON documents cA2A accepts from outside.
+
+Each surface takes arbitrary JSON from a party that has not been authenticated
+yet, and each documents one error family for anything malformed:
+
+- the A2A request a callee serves (``PeerNode.handle``), which parses the
+  delegation chain, holder proof, caller offer and sealed payload, then runs
+  the inbound pipeline up to the first refusal: CA2AError;
+- the authenticated-response envelope (``response.decode``):
+  ResponseAuthenticationFailed, a CA2AError;
+- a revocation snapshot (``RevocationSnapshot.from_dict``): InvalidRevocation;
+- a delegation chain document and a TRACE DAG handed to the offline verifier:
+  CA2AError.
+
+Anything else escaping (TypeError, AttributeError, KeyError, UnicodeError,
+RecursionError) is a crash: on the live path it drops the connection with no
+response, and offline it escapes the verifier's contract. The input is decoded
+the way the reference server decodes a body, so what reaches the parsers is
+exactly what the wire can deliver.
+"""
+
+import contextlib
+import json
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+    from ca2a_runtime import response
+    from ca2a_runtime.delegation import RevocationSnapshot
+    from ca2a_runtime.errors import CA2AError
+    from ca2a_runtime.node import PeerNode
+    from ca2a_runtime.policy import LocalPolicy
+    from ca2a_verify.dag import verify_trace_dag
+    from ca2a_verify.verify import _parse_chain, verify_delegation_chain
+
+_ROOT = Ed25519PrivateKey.from_private_bytes(b"\x01" * 32).public_key().public_bytes_raw().hex()
+_NODE = PeerNode(LocalPolicy.of(["read", "write"]), trusted_root_issuers={_ROOT})
+
+
+def _handle(doc):
+    if isinstance(doc, dict):
+        _NODE.handle(doc)
+
+
+def _revocations(doc):
+    RevocationSnapshot.from_dict(doc)
+
+
+def _chain(doc):
+    verify_delegation_chain(_parse_chain(doc), trusted_root_issuers={_ROOT})
+
+
+def _dag(doc):
+    if isinstance(doc, dict):
+        doc = doc.get("records", doc)
+    if isinstance(doc, list) and doc:
+        verify_trace_dag(doc, trusted_keys=[])
+
+
+_JSON_TARGETS = [_handle, _revocations, _chain, _dag]
+
+
+def TestOneInput(data: bytes) -> None:
+    if not data:
+        return
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, len(_JSON_TARGETS))
+    raw = fdp.ConsumeBytes(fdp.remaining_bytes())
+    if choice == len(_JSON_TARGETS):
+        with contextlib.suppress(CA2AError):
+            response.decode(raw)
+        return
+    try:
+        doc = json.loads(raw)
+    except (ValueError, RecursionError):
+        # The reference server answers 400 before any parser runs.
+        return
+    with contextlib.suppress(CA2AError):
+        _JSON_TARGETS[choice](doc)
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.3.1/.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
+
+  # Refreshes the digest the Dockerfile pins its base image to. Without this the
+  # pin would hold the image at whatever it was on the day it was written.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    # Digest refreshes and 3.11 patch releases only. Moving the image to a new
+    # Python minor is a deliberate change with its own PR and test run.
+    ignore:
+      - dependency-name: "python"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"

ca2a_runtime-0.3.1/.github/workflows/cflite_batch.yml

@@ -0,0 +1,36 @@
+name: ClusterFuzzLite batch
+
+on:
+  schedule:
+    # 04:40 UTC daily, off the hour and off agent-manifest's 04:20 slot.
+    - cron: '40 4 * * *'
+  workflow_dispatch:
+
+permissions: read-all
+
+concurrency:
+  group: cflite-batch
+  cancel-in-progress: false
+
+jobs:
+  fuzz:
+    name: Batch fuzz
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Build fuzzers
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          # Every target, not just what changed. Thirty minutes of fuzzing
+          # leaves room for the base image build inside the 45 minute timeout.
+          fuzz-seconds: 1800
+          mode: batch
+          sanitizer: address

ca2a_runtime-0.3.1/.github/workflows/cflite_pr.yml

@@ -0,0 +1,43 @@
+name: ClusterFuzzLite PR
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'requirements/build.txt'
+      - 'requirements/runtime.txt'
+      - '.clusterfuzzlite/**'
+      - '.github/workflows/cflite_pr.yml'
+
+# Read-only. Findings surface in the job log and the uploaded crash artifact
+# rather than as code-scanning alerts, so no security-events: write is needed.
+permissions: read-all
+
+concurrency:
+  group: cflite-pr-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz changed code
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # Only the address sanitizer. The targets are pure Python under Atheris,
+      # where undefined-behaviour instrumentation has nothing to instrument.
+      - name: Build fuzzers
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 300
+          # code-change fuzzes only what the PR touched, which is what keeps
+          # this inside a PR's time budget. The nightly batch covers the rest.
+          mode: code-change
+          sanitizer: address

{ca2a_runtime-0.3.0 → ca2a_runtime-0.3.1}/.github/workflows/docker.yml

@@ -9,6 +9,8 @@ on:
       - "Dockerfile"
       - ".dockerignore"
       - "pyproject.toml"
+      - "requirements/build.txt"
+      - "requirements/runtime.txt"
       - "src/**"
       - ".github/workflows/docker.yml"
 

{ca2a_runtime-0.3.0 → ca2a_runtime-0.3.1}/.github/workflows/require-maintainer-approval.yml

@@ -13,12 +13,15 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
-  statuses: write
 
 jobs:
   gate:
     runs-on: ubuntu-latest
+    # Reads the PR and its reviews, then fails the job if no maintainer
+    # approved the head commit. It writes nothing, so no write scope.
+    permissions:
+      contents: read
+      pull-requests: read
     if: github.event.pull_request.base.ref == 'main'
     steps:
       - name: Check for maintainer approval

{ca2a_runtime-0.3.0 → ca2a_runtime-0.3.1}/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-09-26
+
+### Fixed
+
+- Malformed input from outside now fails with the documented error instead of
+  escaping as a Python exception. `TdxQuote.parse` confines reads to the declared
+  signature section and checks each nested length (it raised `struct.error` on a
+  short section); `verify_challenge` refuses a MAC that is not 64 lowercase hex
+  (a non-ASCII one raised `TypeError`); `DelegationCredential.from_dict` and
+  `verify_trace_dag` refuse entries that are not objects; the reference server
+  answers 400 to bodies that hit the JSON parser's nesting or integer-digit
+  limits instead of dropping the connection (#202).
+- `canonicalize` refuses non-string object keys. It coerced them with `str()`, so
+  `{1: "a", "1": "b"}` serialized one key twice (#202).
+- The container image installs its dependencies from hash-pinned locks
+  (`requirements/runtime.txt`, `requirements/build.txt`) and pins the base image
+  by digest. ClusterFuzzLite targets cover the wire documents, the attestation
+  parsers and the canonicalizer (#202).
+
 ## [0.3.0] - 2026-09-25
 
 ### Changed
@@ -391,7 +410,8 @@ built/stubbed boundary.
 - The sealed channel does not by itself establish the enclave-held-private-key property; that is a hardware attestation guarantee that lands with real-hardware validation.
 - Alpha schemas: the delegation credential and TRACE link schemas are not yet stable or versioned, and peer attestation evidence is not yet RATS/EAT conformant.
 
-[Unreleased]: https://github.com/agentrust-io/ca2a/compare/v0.3.0...main
+[Unreleased]: https://github.com/agentrust-io/ca2a/compare/v0.3.1...main
+[0.3.1]: https://github.com/agentrust-io/ca2a/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/agentrust-io/ca2a/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/agentrust-io/ca2a/compare/v0.1.0a1...v0.2.0
 [0.1.0a1]: https://github.com/agentrust-io/ca2a/releases/tag/v0.1.0a1

ca2a_runtime-0.3.1/Dockerfile

@@ -0,0 +1,40 @@
+# Base image pinned by its multi-arch index digest, so a re-pushed tag cannot
+# change what is built. Refresh the digest and the tag together.
+FROM python:3.11.15-slim-bookworm@sha256:d29f48a31a8b408ed19272ca1e7b10ebae13b240a27e862d3d4217c528e2e0c3 AS builder
+
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /build
+COPY requirements/build.txt ./requirements/build.txt
+# The build backend comes from a hash-pinned lock, and the wheel is built
+# without build isolation so pip does not fetch an unpinned hatchling of its own.
+RUN python -m pip install --require-hashes -r requirements/build.txt
+COPY pyproject.toml README.md LICENSE NOTICE ./
+COPY src ./src
+RUN python -m pip wheel --no-deps --no-build-isolation --wheel-dir /wheels .
+
+FROM python:3.11.15-slim-bookworm@sha256:d29f48a31a8b408ed19272ca1e7b10ebae13b240a27e862d3d4217c528e2e0c3 AS runtime
+
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PYTHONUNBUFFERED=1
+
+RUN groupadd --gid 10001 ca2a \
+    && useradd --uid 10001 --gid 10001 --no-create-home --home-dir /var/lib/ca2a ca2a \
+    && install -d -o ca2a -g ca2a /var/lib/ca2a /etc/ca2a
+
+# Third-party runtime dependencies from the hash-pinned lock, then the locally
+# built wheel with --no-deps, so nothing in the image is resolved unpinned.
+COPY requirements/runtime.txt /tmp/runtime.txt
+COPY --from=builder /wheels /wheels
+RUN python -m pip install --require-hashes -r /tmp/runtime.txt \
+    && python -m pip install --no-deps /wheels/ca2a_runtime-*.whl \
+    && rm -rf /wheels /tmp/runtime.txt
+
+USER 10001:10001
+WORKDIR /var/lib/ca2a
+EXPOSE 8443
+
+ENTRYPOINT ["ca2a"]
+CMD ["--help"]

{ca2a_runtime-0.3.0 → ca2a_runtime-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ca2a-runtime
-Version: 0.3.0
+Version: 0.3.1
 Summary: Confidential agent-to-agent runtime: attested, attenuated delegation and sealed peer channels for A2A
 Project-URL: Homepage, https://github.com/agentrust-io/ca2a
 Project-URL: Repository, https://github.com/agentrust-io/ca2a

{ca2a_runtime-0.3.0 → ca2a_runtime-0.3.1}/index.md

@@ -16,7 +16,7 @@ cA2A is a profile on A2A that adds signed attenuated delegation, peer appraisal,
 [What this proves, and what it does not](LIMITATIONS.md){ .md-button }
 
 !!! tip "TL;DR"
-    [ca2a-runtime](https://pypi.org/project/ca2a-runtime/) 0.3.0 (MIT developer preview; the PyPI name `ca2a` belongs to an unrelated project) rejects scope escalation offline with no hardware or running peer. SEV-SNP and TDX appraisal ran on real Azure and GCP evidence, including an Azure SEV-SNP peer calling a GCP TDX peer on 2026-07-27, but peer appraisal is one-directional so far and binding the seal to a verified measurement on a live call is on the roadmap.
+    [ca2a-runtime](https://pypi.org/project/ca2a-runtime/) 0.3.1 (MIT developer preview; the PyPI name `ca2a` belongs to an unrelated project) rejects scope escalation offline with no hardware or running peer. SEV-SNP and TDX appraisal ran on real Azure and GCP evidence, including an Azure SEV-SNP peer calling a GCP TDX peer on 2026-07-27, but peer appraisal is one-directional so far and binding the seal to a verified measurement on a live call is on the roadmap.
 
 <div class="grid cards" markdown>
 
@@ -71,4 +71,4 @@ Software and hardware modes provide different assurance. Peer appraisal has been
 
 For the architecture and trust boundaries, read [How It Works](docs/concepts.md). The normative profile, with the delegation chain, sealed channel, and conformance rules, is in [Profile](docs/spec/profile.md).
 
-**Status:** ca2a-runtime 0.3.0 developer preview · MIT · hosting at the Agentic AI Foundation proposed, not accepted · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.
+**Status:** ca2a-runtime 0.3.1 developer preview · MIT · hosting at the Agentic AI Foundation proposed, not accepted · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.

{ca2a_runtime-0.3.0 → ca2a_runtime-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ca2a-runtime"
-version = "0.3.0"
+version = "0.3.1"
 description = "Confidential agent-to-agent runtime: attested, attenuated delegation and sealed peer channels for A2A"
 readme = "README.md"
 license = { text = "MIT" }

ca2a_runtime-0.3.1/requirements/build.in

@@ -0,0 +1,6 @@
+# Build backend for the container image's builder stage. The wheel is built with
+# --no-build-isolation so pip does not fetch hatchling unpinned into a throwaway
+# environment. Compile with:
+#   uv pip compile requirements/build.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/build.txt
+hatchling

ca2a_runtime-0.3.1/requirements/build.txt

@@ -0,0 +1,26 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile requirements/build.in --generate-hashes --universal --python-version 3.11 -o requirements/build.txt
+hatchling==1.32.4 \
+    --hash=sha256:08ecf7548fb48205e7f213d70c71e67b8271b7242093dc3f1da578b42c734a2c \
+    --hash=sha256:c4468f73144c054d2aab4ef0f0378c43b9878bf07f8ffd6b79690e970d375f07
+    # via -r requirements/build.in
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
+    # via hatchling
+pathspec==1.1.1 \
+    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
+    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
+    # via hatchling
+pluggy==1.6.0 \
+    --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
+    --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+    # via hatchling
+tomlkit==0.15.1 \
+    --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
+    --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
+    # via hatchling
+trove-classifiers==2026.9.21.13 \
+    --hash=sha256:0a9ebc8d4e2f3e8a22848c5258033035bec17a3012ac3fea16dbaa764489eb71 \
+    --hash=sha256:8b1ff4f9c191b1040b71c37f1e445ab99732911e3cd91de52838453a854d7a17
+    # via hatchling

ca2a_runtime-0.3.1/requirements/runtime.in

@@ -0,0 +1,12 @@
+# Runtime dependencies for the container image, mirroring [project.dependencies]
+# in pyproject.toml. The Dockerfile installs this lock with --require-hashes and
+# then adds the locally built ca2a-runtime wheel with --no-deps, so nothing in
+# the image is fetched unpinned. Keep it in step with pyproject.toml. Compile with:
+#   uv pip compile requirements/runtime.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/runtime.txt
+cryptography>=50.0
+pyyaml>=6.0
+cedarpy==4.8.7
+agentrust-trace>=0.5
+agent-manifest>=0.11.1
+rfc8785>=0.1