fix: read __version__ from distribution metadata

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Fixed
+
+- **`--version` reported the wrong version.** `__version__` was a second hardcoded literal alongside `pyproject.toml` and never moved, so it sat at `0.2.0` through both the 0.3.0 and 0.4.0 releases: `trace-tests --version` printed `0.2.0` from a 0.4.0 install while `importlib.metadata` correctly returned `0.4.0`. It is now read from installed distribution metadata, so there is one source of truth and the value cannot fall behind a release again.
+
+  This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so `--version` is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer.
+
 ## v0.4.0 — 2026-07-28
 
 ### Changed

src/trace_tests/__init__.py

@@ -1,3 +1,20 @@
 """TRACE conformance test suite."""
 
-__version__ = "0.2.0"
+from importlib.metadata import PackageNotFoundError, version
+
+# Read the version from installed distribution metadata rather than restating it
+# here. `pyproject.toml` is what the build and PyPI publish, so a second literal
+# in this file is a copy that can fall behind silently: it sat at "0.2.0" through
+# both the 0.3.0 and 0.4.0 releases, so `trace-tests --version` reported 0.2.0
+# from a 0.4.0 install. That is worse than cosmetic, because the v0.2 profile
+# cutover landed in 0.4.0 and `--version` is the command someone runs to find out
+# whether they have a suite that accepts v0.2 records.
+try:
+    __version__ = version("agentrust-trace-tests")
+except PackageNotFoundError:  # pragma: no cover - source tree with no install
+    # Importable without being installed (e.g. PYTHONPATH against a checkout).
+    # There is no metadata to read here, and guessing a number would reintroduce
+    # the drift this exists to prevent.
+    __version__ = "0.0.0+unknown"
+
+__all__ = ["__version__"]

tests/unit/test_cli.py

@@ -57,3 +57,29 @@ def test_partial_cmcp_envelope_is_rejected(tmp_path):
     result = CliRunner().invoke(main, ["verify", "--record", str(p), "--level", "0"])
     assert result.exit_code == 2, result.output
     assert "partial cmcp-runtime envelope" in result.output
+
+
+def test_version_matches_distribution_metadata():
+    """`--version` must report the installed distribution version.
+
+    `__version__` was a second hardcoded literal alongside `pyproject.toml` and
+    fell behind through two releases, so a 0.4.0 install reported 0.2.0. Since
+    the v0.2 profile cutover shipped in 0.4.0, `--version` was the one command
+    that could not tell you whether your suite accepts v0.2 records.
+    """
+    from importlib.metadata import version
+
+    expected = version("agentrust-trace-tests")
+    result = CliRunner().invoke(main, ["--version"])
+
+    assert result.exit_code == 0, result.output
+    assert expected in result.output, f"expected {expected!r} in {result.output!r}"
+
+
+def test_dunder_version_is_not_a_stale_literal():
+    """Guard against reverting to a hardcoded `__version__`."""
+    from importlib.metadata import version
+
+    import trace_tests
+
+    assert trace_tests.__version__ == version("agentrust-trace-tests")