chore(release): 0.6.1

[imran-siddique]

Patch release for the crash fixed in #245, which is reachable from untrusted input in the currently published 0.6.0.

Why a release now rather than waiting

pq is an optional extra, so the default install cannot appraise post-quantum signatures. In every published version with PQ support, a manifest declaring ML-DSA-65 or hybrid-Ed25519-ML-DSA-65 crashed verify_manifest() with an uncaught RuntimeError instead of returning a verdict. A verification endpoint answers 500 to an attacker-supplied manifest; no key material and no valid signature are needed to trigger it. cmcp and ca2a both consume this verifier through the published package, so the fix does nothing for them until it ships.

Contents

Fixed

• Unavailable algorithm now yields UNVERIFIABLE with the reason recorded as a warning, never an exception and never MISMATCH (fix(verify): return UNVERIFIABLE when an algorithm is unavailable; amend ADR-0005 #245).
• A signature block with no algorithm no longer falls back to Ed25519; a missing identifier is a signature.algorithm mismatch (docs(adr): ADR-0011, the manifest is a signed document not a JWT/JOSE profile #241).

Documentation and spec

• ADR-0005 amended: two profile values not three, post-quantum at Level 3, UNVERIFIABLE rather than INCOMPATIBLE_VERSION (fix(verify): return UNVERIFIABLE when an algorithm is unavailable; amend ADR-0005 #245).
• ADR-0011 accepted: the manifest is a signed document, not a JWT/JOSE profile, and the envelope moves to COSE_Sign1 in spec v0.2 (docs(adr): ADR-0011, the manifest is a signed document not a JWT/JOSE profile #241, docs(adr): accept ADR-0011, envelope moves to COSE_Sign1 in v0.2 #242). Migration tracked in Migrate the manifest signature envelope to COSE_Sign1 (ADR-0011, spec v0.2) #243.
• Spec section 10.5: term-by-term SCITT mapping, and what the spec deliberately does not restate (docs(spec): map Agent Manifest onto SCITT terms (section 10.5) #244).
• Spec section 3.6 algorithm-binding rule, section 4.2 UNVERIFIABLE requirement, and three corrected factual errors including EAT cited as RFC 9528.

Nothing here changes how a manifest is signed. No previously VALID manifest becomes invalid: the two verifier changes affect a path that used to crash and a path that used to silently assume Ed25519.

Verification

• 621 passed, 18 skipped
• python -m build plus twine check: both artifacts PASSED for 0.6.1

After merge: tag python-v0.6.1 to trigger the OIDC publish, then confirm the fix from the installed PyPI package rather than from the local tree.