From ec779bae3ca271794a174caea4c0e353c28ac18f Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 27 Jul 2026 21:27:11 -0700 Subject: [PATCH] fix(deps): bump every trace pin to the v0.2 cutover The profile-URI PR bumped only the two dependency files an earlier grep surfaced, because that grep was truncated with head -3. Nine more declarations still pinned the pre-cutover releases, including two exact pins in plugins/agentrust-codex/requirements.txt. The result was a producer emitting v0.2 records against a conformance suite that still required v0.1, which is exactly the mismatch the cutover sequencing was supposed to avoid. It failed on main as: TR-ENV FAIL eat_profile must be 'tag:agentrust.io,2026:trace-v0.1', got 'tag:agentrust-io.com,2026:trace-v0.2' Every declaration now names 0.5.0 / 0.4.0, including the integration.yaml manifests, which are documentation of what an integration was validated against rather than installed pins, and were also stale. Co-Authored-By: Claude Opus 5 (1M context) --- claude-code/integration.yaml | 4 ++-- integrations/comply54/integration.yaml | 2 +- integrations/sage-agenttrust/integration.yaml | 2 +- integrations/sentinel/requirements-dev.txt | 2 +- integrations/spendguard/integration.yaml | 2 +- plugins/agentrust-codex/integration.yaml | 2 +- plugins/agentrust-codex/requirements.txt | 4 ++-- scheduled-agents/integration.yaml | 4 ++-- scheduled-agents/requirements.txt | 4 ++-- 9 files changed, 13 insertions(+), 13 deletions(-) diff --git a/claude-code/integration.yaml b/claude-code/integration.yaml index 423a429..7c5866f 100644 --- a/claude-code/integration.yaml +++ b/claude-code/integration.yaml @@ -12,5 +12,5 @@ tier: community trace_conformance_level: 0 tested_against: agent-manifest: 0.3.0 - agentrust-trace: 0.3.0 - agentrust-trace-tests: 0.2.0 + agentrust-trace: 0.5.0 + agentrust-trace-tests: 0.4.0 diff --git a/integrations/comply54/integration.yaml b/integrations/comply54/integration.yaml index aa9d036..0a0bb0f 100644 --- a/integrations/comply54/integration.yaml +++ b/integrations/comply54/integration.yaml @@ -14,4 +14,4 @@ license: Apache-2.0 tier: community trace_conformance_level: 0 tested_against: - agentrust-trace: "0.1.0" + agentrust-trace: "0.5.0" diff --git a/integrations/sage-agenttrust/integration.yaml b/integrations/sage-agenttrust/integration.yaml index 3584080..7abc8dd 100644 --- a/integrations/sage-agenttrust/integration.yaml +++ b/integrations/sage-agenttrust/integration.yaml @@ -19,4 +19,4 @@ tier: community trace_conformance_level: 0 tested_against: cmcp-runtime: "0.2.1" - agentrust-trace: "0.2.0" + agentrust-trace: "0.5.0" diff --git a/integrations/sentinel/requirements-dev.txt b/integrations/sentinel/requirements-dev.txt index efcb6f5..88598c0 100644 --- a/integrations/sentinel/requirements-dev.txt +++ b/integrations/sentinel/requirements-dev.txt @@ -1,3 +1,3 @@ -r requirements.txt -agentrust-trace-tests>=0.2.0 +agentrust-trace-tests>=0.4,<0.5 jsonschema>=4.0.0 diff --git a/integrations/spendguard/integration.yaml b/integrations/spendguard/integration.yaml index fc3dc2e..92846bf 100644 --- a/integrations/spendguard/integration.yaml +++ b/integrations/spendguard/integration.yaml @@ -14,4 +14,4 @@ tier: community # 0.1.0 does not grade signatures on plain trace records (see README). trace_conformance_level: 0 tested_against: - agentrust-trace: "0.3.0" + agentrust-trace: "0.5.0" diff --git a/plugins/agentrust-codex/integration.yaml b/plugins/agentrust-codex/integration.yaml index 830199a..f60a1a0 100644 --- a/plugins/agentrust-codex/integration.yaml +++ b/plugins/agentrust-codex/integration.yaml @@ -12,4 +12,4 @@ tier: community trace_conformance_level: 0 tested_against: agent-manifest: 0.3.0 - agentrust-trace: 0.3.0 + agentrust-trace: 0.5.0 diff --git a/plugins/agentrust-codex/requirements.txt b/plugins/agentrust-codex/requirements.txt index 781f873..17e7d6f 100644 --- a/plugins/agentrust-codex/requirements.txt +++ b/plugins/agentrust-codex/requirements.txt @@ -1,5 +1,5 @@ # Snapshot, drift detection, and SessionStart use the Python standard library. # Install these released packages only when generating signed records. agent-manifest==0.3.0 -agentrust-trace==0.3.0 -agentrust-trace-tests==0.2.0 +agentrust-trace>=0.5 +agentrust-trace-tests>=0.4,<0.5 diff --git a/scheduled-agents/integration.yaml b/scheduled-agents/integration.yaml index b1dc1da..b271b18 100644 --- a/scheduled-agents/integration.yaml +++ b/scheduled-agents/integration.yaml @@ -10,5 +10,5 @@ license: Apache-2.0 tier: community trace_conformance_level: 0 tested_against: - agentrust-trace: 0.3.0 - agentrust-trace-tests: 0.2.0 + agentrust-trace: 0.5.0 + agentrust-trace-tests: 0.4.0 diff --git a/scheduled-agents/requirements.txt b/scheduled-agents/requirements.txt index d8161ff..084b32f 100644 --- a/scheduled-agents/requirements.txt +++ b/scheduled-agents/requirements.txt @@ -3,5 +3,5 @@ # # Required only to sign a TRACE record (/schedule-trace, /schedule-manifest # approve --sign). Verified against the PyPI releases below in a clean virtualenv. -agentrust-trace>=0.3 -agentrust-trace-tests>=0.2 +agentrust-trace>=0.5 +agentrust-trace-tests>=0.4,<0.5