ca2a-runtime 0.3.0__tar.gz → 0.4.0__tar.gz

ca2a_runtime-0.4.0/.clusterfuzzlite/Dockerfile

@@ -0,0 +1,5 @@
+FROM gcr.io/oss-fuzz-base/base-builder-python
+
+COPY . $SRC/ca2a
+COPY .clusterfuzzlite/build.sh $SRC/build.sh
+WORKDIR $SRC/ca2a

ca2a_runtime-0.4.0/.clusterfuzzlite/README.md

@@ -0,0 +1,60 @@
+# Fuzzing
+
+Coverage-guided fuzzing via [ClusterFuzzLite](https://google.github.io/clusterfuzzlite/),
+running Atheris against the input cA2A reads before it has decided to trust the
+party that sent it. Mirrors the setup in agentrust-io/agent-manifest and
+agentrust-io/cmcp.
+
+## What is fuzzed
+
+| Target | Surface |
+| --- | --- |
+| `fuzz_wire_documents.py` | JSON from outside: the A2A request `PeerNode.handle` serves (delegation chain, holder proof, caller offer, sealed payload), the authenticated-response envelope, a revocation snapshot, and the chain and TRACE DAG documents the offline verifier loads. |
+| `fuzz_attestation_parsers.py` | TDX quote, SEV-SNP report, TPM quote and TPMT_SIGNATURE parsing, plus `verify_challenge` over caller-supplied challenge text. |
+| `fuzz_canonical_json.py` | The RFC 8785 bytes every credential, holder proof, revocation statement and response MAC is computed over. |
+
+## The properties
+
+The wire and parser targets assert that each surface fails closed: it returns,
+or raises the error family it documents (`CA2AError`, and `AttestationFailed`
+for evidence). A `TypeError`, `struct.error`, `AttributeError` or
+`RecursionError` escaping means a caller written against the documented
+exception will not catch it, and on the reference server the connection drops
+with no response.
+
+`fuzz_canonical_json.py` asserts a round trip: parsing the canonical output must
+reproduce the input exactly, and integers outside +/-(2**53 - 1) must be
+refused. cA2A's data model has no floats, so the comparison is exact.
+
+## Standing when added
+
+A local plain-Python run of each `TestOneInput` (Atheris does not install on the
+Windows machine it was written on) found three escapes that are fixed in the
+same change, with regression tests: `TdxQuote.parse` raising `struct.error` on a
+quote whose signature section is shorter than its declared contents,
+`verify_challenge` raising `TypeError` on a non-ASCII MAC, and
+`DelegationCredential.from_dict` raising `TypeError` on a hop that is not an
+object.
+
+## Bundling gotcha
+
+`compile_python_fuzzer` bundles each target with PyInstaller, which follows
+static imports only and bundles code, not package data. `build.sh` passes
+`--collect-submodules=email` for the lazy `email.mime` import in the
+cryptography and pydantic stacks, and `--collect-data` for `agentrust_trace`,
+whose TRACE schema `ca2a_verify.dag` loads at import time.
+
+## Running locally
+
+```
+git clone https://github.com/google/clusterfuzzlite --depth 1 /tmp/clusterfuzzlite
+python /tmp/clusterfuzzlite/infra/helper.py build_image --external $PWD
+python /tmp/clusterfuzzlite/infra/helper.py build_fuzzers --external --sanitizer address $PWD
+python /tmp/clusterfuzzlite/infra/helper.py run_fuzzer --external $PWD fuzz_wire_documents
+```
+
+## In CI
+
+`cflite_pr.yml` fuzzes code the pull request touched, for five minutes.
+`cflite_batch.yml` runs every target for thirty minutes, nightly. Both are
+read-only and time out at 45 minutes; the oss-fuzz base image build dominates.

ca2a_runtime-0.4.0/.clusterfuzzlite/build.sh

@@ -0,0 +1,29 @@
+#!/bin/bash -eu
+# Build the fuzz targets for ClusterFuzzLite.
+#
+# Installed rather than put on the path so the targets exercise the same import
+# surface a consumer gets. Third-party dependencies come from the same
+# hash-pinned locks the container image uses, and the package goes in with
+# --no-deps and without build isolation, so nothing here resolves unpinned.
+
+cd "$SRC/ca2a"
+pip3 install --no-cache-dir --require-hashes -r requirements/build.txt
+pip3 install --no-cache-dir --require-hashes -r requirements/runtime.txt
+pip3 install --no-cache-dir --no-deps --no-build-isolation .
+
+# compile_python_fuzzer bundles each target with PyInstaller, which follows
+# static imports only and bundles code, not package data.
+PYI_ARGS=(
+  # The cryptography and pydantic stacks reach email.mime lazily; without this
+  # the bundled target dies with ModuleNotFoundError, which libFuzzer reports
+  # as a crash in the target.
+  --collect-submodules=email
+  # ca2a_verify.dag validates records against the TRACE JSON schema, which
+  # agentrust_trace loads from inside its package at import time.
+  --collect-data=agentrust_trace
+  --collect-data=agent_manifest
+)
+
+for target in "$SRC"/ca2a/.clusterfuzzlite/fuzz_*.py; do
+  compile_python_fuzzer "$target" "${PYI_ARGS[@]}"
+done

ca2a_runtime-0.4.0/.clusterfuzzlite/fuzz_attestation_parsers.py

@@ -0,0 +1,62 @@
+#!/usr/bin/python3
+"""Fuzz the attestation evidence parsers.
+
+A callee reads a caller's evidence (``raw_evidence`` in a ``caller_offer``)
+before deciding to trust anything about it, and an auditor feeds recorded
+quotes to ``ca2a_verify`` offline. These parsers read that binary at fixed
+offsets under declared lengths the blob itself supplies: a TDX quote with four
+nested size fields, an SNP report, a TPM quote and a TPMT_SIGNATURE.
+
+The property is that each fails closed: it returns, or raises
+AttestationFailed, the error the verifier documents. A struct.error, IndexError
+or OverflowError reaching the caller means a declared length was believed. That
+is the bug this target was written against: TdxQuote.parse used to raise
+struct.error on a quote whose signature section was shorter than it claimed.
+
+The challenge verifier is included because its input, the offer nonce and the
+holder proof's challenge, is caller text read before anything authenticates it.
+"""
+
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from ca2a_runtime.challenge import verify_challenge
+    from ca2a_runtime.errors import AttestationFailed
+    from ca2a_runtime.tee.sev_snp import SevSnpReport
+    from ca2a_runtime.tee.tdx import TdxQuote
+    from ca2a_runtime.tee.tpm import TpmQuote
+    from ca2a_verify.tpm import parse_tpmt_signature
+
+_SECRET = b"\x00" * 32
+
+_PARSERS = [
+    TdxQuote.parse,
+    SevSnpReport.parse,
+    TpmQuote.parse,
+    parse_tpmt_signature,
+]
+
+
+def TestOneInput(data: bytes) -> None:
+    if not data:
+        return
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, len(_PARSERS))
+    try:
+        if choice == len(_PARSERS):
+            verify_challenge(_SECRET, fdp.ConsumeUnicode(fdp.remaining_bytes()))
+        else:
+            _PARSERS[choice](fdp.ConsumeBytes(fdp.remaining_bytes()))
+    except AttestationFailed:
+        pass
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.4.0/.clusterfuzzlite/fuzz_canonical_json.py

@@ -0,0 +1,89 @@
+#!/usr/bin/python3
+"""Fuzz the RFC 8785 canonicalizer for the invariant its signatures depend on.
+
+canonicalize() produces the bytes every delegation credential, holder proof,
+revocation statement and response MAC is computed over, so the bytes must be a
+faithful, lossless encoding of the input. The property asserted is a round trip:
+parsing the canonical output back must reproduce the input exactly.
+
+A crash-only check would pass over the bugs that matter here. The ones found in
+sibling canonicalizers were silent: two distinct keys serialized as one key
+twice, a parser kept one of the pair, and a field vanished from a document whose
+signature claimed to cover it.
+
+Structure is built from the fuzz data rather than by mutating JSON text, so the
+budget goes on key and value shapes (combining marks, surrogate pairs, control
+characters, integers straddling 2**53) rather than on producing valid JSON.
+"""
+
+import json
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from ca2a_runtime.canonical import canonicalize
+
+_MAX_DEPTH = 4
+_MAX_ITEMS = 6
+_SAFE = 2**53 - 1
+
+
+def _build(fdp, depth=0):
+    if depth >= _MAX_DEPTH or fdp.remaining_bytes() == 0:
+        return fdp.ConsumeUnicodeNoSurrogates(16)
+    kind = fdp.ConsumeIntInRange(0, 6)
+    if kind == 0:
+        return None
+    if kind == 1:
+        return fdp.ConsumeBool()
+    if kind == 2:
+        # Straddle the safe-integer boundary: outside it canonicalize() must
+        # refuse rather than emit digits a conforming verifier would not.
+        return fdp.ConsumeIntInRange(-(2**54), 2**54)
+    if kind == 3:
+        return fdp.ConsumeUnicodeNoSurrogates(64)
+    if kind == 4:
+        return [_build(fdp, depth + 1) for _ in range(fdp.ConsumeIntInRange(0, _MAX_ITEMS))]
+    return {
+        fdp.ConsumeUnicodeNoSurrogates(24): _build(fdp, depth + 1)
+        for _ in range(fdp.ConsumeIntInRange(0, _MAX_ITEMS))
+    }
+
+
+def _has_unsafe_int(value):
+    if isinstance(value, bool):
+        return False
+    if isinstance(value, int):
+        return not -_SAFE <= value <= _SAFE
+    if isinstance(value, dict):
+        return any(_has_unsafe_int(v) for v in value.values())
+    if isinstance(value, list):
+        return any(_has_unsafe_int(v) for v in value)
+    return False
+
+
+def TestOneInput(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    value = _build(fdp)
+    try:
+        out = canonicalize(value)
+    except ValueError:
+        # Declared: integers outside the RFC 8785 safe domain, and only those.
+        assert _has_unsafe_int(value), "canonicalize() refused an in-domain value"
+        return
+    assert not _has_unsafe_int(value), "an out-of-domain integer was serialized"
+
+    # cA2A's data model has no floats, so every number re-parses as the int it
+    # was and the round trip can be asserted exactly, bools included.
+    assert json.loads(out) == value, f"canonical bytes did not round-trip: {out!r}"
+    assert canonicalize(json.loads(out)) == out, "canonical form is not a fixed point"
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.4.0/.clusterfuzzlite/fuzz_wire_documents.py

@@ -0,0 +1,92 @@
+#!/usr/bin/python3
+"""Fuzz the JSON documents cA2A accepts from outside.
+
+Each surface takes arbitrary JSON from a party that has not been authenticated
+yet, and each documents one error family for anything malformed:
+
+- the A2A request a callee serves (``PeerNode.handle``), which parses the
+  delegation chain, holder proof, caller offer and sealed payload, then runs
+  the inbound pipeline up to the first refusal: CA2AError;
+- the authenticated-response envelope (``response.decode``):
+  ResponseAuthenticationFailed, a CA2AError;
+- a revocation snapshot (``RevocationSnapshot.from_dict``): InvalidRevocation;
+- a delegation chain document and a TRACE DAG handed to the offline verifier:
+  CA2AError.
+
+Anything else escaping (TypeError, AttributeError, KeyError, UnicodeError,
+RecursionError) is a crash: on the live path it drops the connection with no
+response, and offline it escapes the verifier's contract. The input is decoded
+the way the reference server decodes a body, so what reaches the parsers is
+exactly what the wire can deliver.
+"""
+
+import contextlib
+import json
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+    from ca2a_runtime import response
+    from ca2a_runtime.delegation import RevocationSnapshot
+    from ca2a_runtime.errors import CA2AError
+    from ca2a_runtime.node import PeerNode
+    from ca2a_runtime.policy import LocalPolicy
+    from ca2a_verify.dag import verify_trace_dag
+    from ca2a_verify.verify import _parse_chain, verify_delegation_chain
+
+_ROOT = Ed25519PrivateKey.from_private_bytes(b"\x01" * 32).public_key().public_bytes_raw().hex()
+_NODE = PeerNode(LocalPolicy.of(["read", "write"]), trusted_root_issuers={_ROOT})
+
+
+def _handle(doc):
+    if isinstance(doc, dict):
+        _NODE.handle(doc)
+
+
+def _revocations(doc):
+    RevocationSnapshot.from_dict(doc)
+
+
+def _chain(doc):
+    verify_delegation_chain(_parse_chain(doc), trusted_root_issuers={_ROOT})
+
+
+def _dag(doc):
+    if isinstance(doc, dict):
+        doc = doc.get("records", doc)
+    if isinstance(doc, list) and doc:
+        verify_trace_dag(doc, trusted_keys=[])
+
+
+_JSON_TARGETS = [_handle, _revocations, _chain, _dag]
+
+
+def TestOneInput(data: bytes) -> None:
+    if not data:
+        return
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, len(_JSON_TARGETS))
+    raw = fdp.ConsumeBytes(fdp.remaining_bytes())
+    if choice == len(_JSON_TARGETS):
+        with contextlib.suppress(CA2AError):
+            response.decode(raw)
+        return
+    try:
+        doc = json.loads(raw)
+    except (ValueError, RecursionError):
+        # The reference server answers 400 before any parser runs.
+        return
+    with contextlib.suppress(CA2AError):
+        _JSON_TARGETS[choice](doc)
+
+
+def main() -> None:
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()

ca2a_runtime-0.4.0/.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
+
+  # Refreshes the digest the Dockerfile pins its base image to. Without this the
+  # pin would hold the image at whatever it was on the day it was written.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    # Digest refreshes and 3.11 patch releases only. Moving the image to a new
+    # Python minor is a deliberate change with its own PR and test run.
+    ignore:
+      - dependency-name: "python"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"

ca2a_runtime-0.4.0/.github/workflows/cflite_batch.yml

@@ -0,0 +1,36 @@
+name: ClusterFuzzLite batch
+
+on:
+  schedule:
+    # 04:40 UTC daily, off the hour and off agent-manifest's 04:20 slot.
+    - cron: '40 4 * * *'
+  workflow_dispatch:
+
+permissions: read-all
+
+concurrency:
+  group: cflite-batch
+  cancel-in-progress: false
+
+jobs:
+  fuzz:
+    name: Batch fuzz
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Build fuzzers
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          # Every target, not just what changed. Thirty minutes of fuzzing
+          # leaves room for the base image build inside the 45 minute timeout.
+          fuzz-seconds: 1800
+          mode: batch
+          sanitizer: address

ca2a_runtime-0.4.0/.github/workflows/cflite_pr.yml

@@ -0,0 +1,43 @@
+name: ClusterFuzzLite PR
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'requirements/build.txt'
+      - 'requirements/runtime.txt'
+      - '.clusterfuzzlite/**'
+      - '.github/workflows/cflite_pr.yml'
+
+# Read-only. Findings surface in the job log and the uploaded crash artifact
+# rather than as code-scanning alerts, so no security-events: write is needed.
+permissions: read-all
+
+concurrency:
+  group: cflite-pr-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz changed code
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # Only the address sanitizer. The targets are pure Python under Atheris,
+      # where undefined-behaviour instrumentation has nothing to instrument.
+      - name: Build fuzzers
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 300
+          # code-change fuzzes only what the PR touched, which is what keeps
+          # this inside a PR's time budget. The nightly batch covers the rest.
+          mode: code-change
+          sanitizer: address

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/.github/workflows/codeql.yml

@@ -28,16 +28,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: python
           queries: +security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         continue-on-error: true
         with:
           category: /language:python

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/.github/workflows/docker.yml

@@ -9,6 +9,8 @@ on:
       - "Dockerfile"
       - ".dockerignore"
       - "pyproject.toml"
+      - "requirements/build.txt"
+      - "requirements/runtime.txt"
       - "src/**"
       - ".github/workflows/docker.yml"
 

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/.github/workflows/require-maintainer-approval.yml

@@ -13,12 +13,15 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
-  statuses: write
 
 jobs:
   gate:
     runs-on: ubuntu-latest
+    # Reads the PR and its reviews, then fails the job if no maintainer
+    # approved the head commit. It writes nothing, so no write scope.
+    permissions:
+      contents: read
+      pull-requests: read
     if: github.event.pull_request.base.ref == 'main'
     steps:
       - name: Check for maintainer approval

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/.github/workflows/scorecard.yml

@@ -38,6 +38,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: scorecard-results.sarif

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/CHANGELOG.md

@@ -7,6 +7,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-09-30
+
+### Security
+
+- A delegate with no enclave could be recorded as `caller_attestation="hardware"`
+  by relaying an honest hardware peer's attestation: it asked that peer's public
+  `/.well-known/ca2a/channel` endpoint to attest under the target's challenge and
+  presented the result as its `caller_offer`. Caller offers are now minted in a
+  separate role, signed under their own binding prefixes (`ca2a-*-caller-v2|`),
+  and the handshake endpoint only mints callee-role offers. The caller must also
+  send `caller_possession`, a MAC over the request transcript keyed from X25519
+  between its attested channel key and the callee's, which the callee verifies
+  before recording any outcome.
+
+### Changed
+
+- **Breaking for callers that send `caller_offer`** (`ca2a-caller-offer-v2`). A
+  pre-v2 caller offer has no `role` and no `caller_possession` and is refused with
+  `ATTESTATION_FAILED`. Callers that send no offer, and the handshake response,
+  are unchanged on the wire. `BaseProvider.attest` and the binding helpers
+  (`tpm_qualifying_data`, `snp_report_data`, `tdx_report_data`) take a keyword
+  `role`, defaulting to the callee role; a custom `Verifier` must derive the
+  binding under `report.role`.
+
+## [0.3.1] - 2026-09-26
+
+### Fixed
+
+- Malformed input from outside now fails with the documented error instead of
+  escaping as a Python exception. `TdxQuote.parse` confines reads to the declared
+  signature section and checks each nested length (it raised `struct.error` on a
+  short section); `verify_challenge` refuses a MAC that is not 64 lowercase hex
+  (a non-ASCII one raised `TypeError`); `DelegationCredential.from_dict` and
+  `verify_trace_dag` refuse entries that are not objects; the reference server
+  answers 400 to bodies that hit the JSON parser's nesting or integer-digit
+  limits instead of dropping the connection (#202).
+- `canonicalize` refuses non-string object keys. It coerced them with `str()`, so
+  `{1: "a", "1": "b"}` serialized one key twice (#202).
+- The container image installs its dependencies from hash-pinned locks
+  (`requirements/runtime.txt`, `requirements/build.txt`) and pins the base image
+  by digest. ClusterFuzzLite targets cover the wire documents, the attestation
+  parsers and the canonicalizer (#202).
+
 ## [0.3.0] - 2026-09-25
 
 ### Changed
@@ -391,7 +434,9 @@ built/stubbed boundary.
 - The sealed channel does not by itself establish the enclave-held-private-key property; that is a hardware attestation guarantee that lands with real-hardware validation.
 - Alpha schemas: the delegation credential and TRACE link schemas are not yet stable or versioned, and peer attestation evidence is not yet RATS/EAT conformant.
 
-[Unreleased]: https://github.com/agentrust-io/ca2a/compare/v0.3.0...main
+[Unreleased]: https://github.com/agentrust-io/ca2a/compare/v0.4.0...main
+[0.4.0]: https://github.com/agentrust-io/ca2a/compare/v0.3.1...v0.4.0
+[0.3.1]: https://github.com/agentrust-io/ca2a/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/agentrust-io/ca2a/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/agentrust-io/ca2a/compare/v0.1.0a1...v0.2.0
 [0.1.0a1]: https://github.com/agentrust-io/ca2a/releases/tag/v0.1.0a1

ca2a_runtime-0.4.0/Dockerfile

@@ -0,0 +1,40 @@
+# Base image pinned by its multi-arch index digest, so a re-pushed tag cannot
+# change what is built. Refresh the digest and the tag together.
+FROM python:3.11.16-slim-bookworm@sha256:a36c24f9cbdf4fd0f52d67f0823eeac19c2028c637cecc392d97f980d4fec56b AS builder
+
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /build
+COPY requirements/build.txt ./requirements/build.txt
+# The build backend comes from a hash-pinned lock, and the wheel is built
+# without build isolation so pip does not fetch an unpinned hatchling of its own.
+RUN python -m pip install --require-hashes -r requirements/build.txt
+COPY pyproject.toml README.md LICENSE NOTICE ./
+COPY src ./src
+RUN python -m pip wheel --no-deps --no-build-isolation --wheel-dir /wheels .
+
+FROM python:3.11.16-slim-bookworm@sha256:a36c24f9cbdf4fd0f52d67f0823eeac19c2028c637cecc392d97f980d4fec56b AS runtime
+
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PYTHONUNBUFFERED=1
+
+RUN groupadd --gid 10001 ca2a \
+    && useradd --uid 10001 --gid 10001 --no-create-home --home-dir /var/lib/ca2a ca2a \
+    && install -d -o ca2a -g ca2a /var/lib/ca2a /etc/ca2a
+
+# Third-party runtime dependencies from the hash-pinned lock, then the locally
+# built wheel with --no-deps, so nothing in the image is resolved unpinned.
+COPY requirements/runtime.txt /tmp/runtime.txt
+COPY --from=builder /wheels /wheels
+RUN python -m pip install --require-hashes -r /tmp/runtime.txt \
+    && python -m pip install --no-deps /wheels/ca2a_runtime-*.whl \
+    && rm -rf /wheels /tmp/runtime.txt
+
+USER 10001:10001
+WORKDIR /var/lib/ca2a
+EXPOSE 8443
+
+ENTRYPOINT ["ca2a"]
+CMD ["--help"]

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ca2a-runtime
-Version: 0.3.0
+Version: 0.4.0
 Summary: Confidential agent-to-agent runtime: attested, attenuated delegation and sealed peer channels for A2A
 Project-URL: Homepage, https://github.com/agentrust-io/ca2a
 Project-URL: Repository, https://github.com/agentrust-io/ca2a
@@ -22,7 +22,7 @@ Classifier: Topic :: Security
 Requires-Python: >=3.11
 Requires-Dist: agent-manifest>=0.11.1
 Requires-Dist: agentrust-trace>=0.5
-Requires-Dist: cedarpy==4.8.7
+Requires-Dist: cedarpy==4.12.1
 Requires-Dist: cryptography>=50.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rfc8785>=0.1
@@ -30,7 +30,7 @@ Provides-Extra: a2a-sdk
 Requires-Dist: a2a-sdk<2,>=1.1; extra == 'a2a-sdk'
 Requires-Dist: aiohttp>=3.14.3; extra == 'a2a-sdk'
 Provides-Extra: dev
-Requires-Dist: a2a-sdk[http-server]==1.1.4; extra == 'dev'
+Requires-Dist: a2a-sdk[http-server]==1.1.5; extra == 'dev'
 Requires-Dist: agentrust-trace-tests<0.6,>=0.4; extra == 'dev'
 Requires-Dist: aiohttp>=3.14.3; extra == 'dev'
 Requires-Dist: bandit[toml]>=1.7; extra == 'dev'

{ca2a_runtime-0.3.0 → ca2a_runtime-0.4.0}/docs/spec/attestation.md

@@ -23,13 +23,20 @@ binding = sha256(prefix || len32(public_key) || public_key || len32(nonce) || no
 | AMD SEV-SNP | `ca2a-snp-v1\|` | `REPORT_DATA` (64 bytes) | the binding, zero-padded on the right |
 | Intel TDX | `ca2a-tdx-v1\|` | `REPORTDATA` (64 bytes) | the binding, zero-padded on the right |
 
+Those are the **callee-role** prefixes: what the handshake endpoint signs. A caller
+offer (see [mutual attestation](mutual-attestation.md)) is signed under its own
+prefix per platform, `ca2a-tpm-caller-v2|`, `ca2a-snp-caller-v2|` and
+`ca2a-tdx-caller-v2|`, selected by the report's `role`. A verifier MUST derive the
+binding under the report's role, so an offer relabelled from one role to the other
+recomputes different bytes and is rejected.
+
 Committing the nonce alone would sign for freshness only, leaving `public_key` an unsigned assertion, so sealing a payload "to a key from a verified report" would not actually be rooted in hardware. A verifier re-derives this value from the report's own fields and requires equality, which is what promotes `public_key` and `nonce` from claim to signed fact. A report whose key was substituted after collection is rejected.
 
 Three encoding details are load-bearing, and each prefix is versioned because this is wire format: a peer and its verifier MUST derive identical bytes.
 
 - **Hashed, not raw.** `TPM2B_DATA` is capped below 64 bytes on some platforms (Azure returns `TPM_RC_SIZE`), and 32 bytes always fits. SEV-SNP and TDX reserve 64, so the digest is left-aligned and zero-padded, which is the convention the kernel's own callers and `agent-manifest` use; a report collected by either runtime is then byte-comparable.
 - **Length-prefixed, not delimiter-joined.** With a delimiter a value containing it shifts the split without changing the digest, so `("a|b", "c")` and `("a", "b|c")` would commit identical bytes and a peer could bind a key other than the one it appears to offer. `nonce` is an arbitrary caller-supplied string, so that is reachable rather than theoretical.
-- **Domain-separated per platform.** The three prefixes differ so a report collected on one platform cannot be replayed as another's evidence.
+- **Domain-separated per platform and per role.** The prefixes differ so a report collected on one platform cannot be replayed as another's evidence, and so a callee offer, which anybody can obtain from the public handshake endpoint under a nonce of their choosing, cannot be presented as a caller offer.
 
 `ca2a_runtime.tee.binding` holds the single derivation the three providers share.