From 2c9107b4c0065e87b060982870068f2ec2982897 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Tue, 21 Jul 2026 11:38:33 -0700 Subject: [PATCH] chore: bump agentrust-trace to >=0.4 (drop <0.4 workaround cap) The <0.4 cap worked around published agentrust-trace 0.3.0 lacking the TRACE A2A delegation block that cA2A records carry. 0.4.0 ships that block, so the cap is removed. cA2A owns the delegation-block semantics natively (trace_binding / ca2a_verify.dag); no code shim was involved. 201 tests + ruff + mypy pass against 0.4.0. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 8 ++++++++ pyproject.toml | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c6e0901..c53c446 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- Bumped `agentrust-trace` to `>=0.4`. The previous `<0.4` cap worked around the + published 0.3.0 lacking the TRACE A2A `delegation` block that cA2A records + carry; 0.4.0 ships that block, so the cap is removed. cA2A still owns the + delegation-block semantics natively (`trace_binding`/`ca2a_verify.dag`); no + code shim was needed. All tests pass against 0.4.0. + ### Added - A2A transport adapter (`ca2a_runtime.transport`): parse/attach cA2A extension diff --git a/pyproject.toml b/pyproject.toml index 6f8a4e9..eca3b67 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -30,7 +30,7 @@ dependencies = [ # TRACE record models + RFC 8785 signing, reused rather than reimplemented # (see ROADMAP Tier 0). Pin a compatible minor; cross-repo skew is a known # risk documented in LIMITATIONS.md. - "agentrust-trace>=0.3,<0.4", + "agentrust-trace>=0.4", "rfc8785>=0.1", ]