chore(release): 0.6.1

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to Agent Manifest are documented here. Format follows [Keep
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-07-27
+
+Closes a crash in `verify_manifest()` reachable from untrusted input on a default install, and settles the signature-envelope question for v0.2. No change to how manifests are signed or to any existing verification result.
+
 ### Fixed
 
 **[SDK]** **`verify_manifest()` no longer raises on a post-quantum manifest when the `pq` extra is absent.** `pyoqs` is optional, so on a default install any manifest declaring `ML-DSA-65` or `hybrid-Ed25519-ML-DSA-65` reached `_require_oqs()` and crashed the engine with an uncaught `RuntimeError`. Since a manifest is untrusted input, a verification endpoint would answer 500 to an attacker-supplied manifest rather than returning a verdict. `_require_oqs()` now raises `AlgorithmUnavailableError` (a `RuntimeError` subclass, so existing callers are unaffected), the engine catches it, records the reason as a warning, and returns **`UNVERIFIABLE`**. Not `MISMATCH`: the verifier has established nothing about a manifest that may be entirely valid, so accusing it of a defect would be wrong. An algorithm identifier outside the registry remains a `MISMATCH`, rejected by the schema enum before verification runs.
@@ -16,9 +20,9 @@ All notable changes to Agent Manifest are documented here. Format follows [Keep
 
 **[SPEC]** New **section 10.5, SCITT profile mapping**. Maps every structural piece of this specification to its RFC 9943 term (Artifact, Subject, Statement, Issuer, Signed Statement, Transparency Service, Receipt, Transparent Statement, Registration Policy, Auditor), which turns "agent-layer profile of SCITT" into a checkable claim and tells an implementer which parts are agent-specific (sections 3.2 to 3.5) and which are inherited. The section also states what the spec deliberately does not restate: OpenSSF Model Signing for the model artifact, SLSA and in-toto for build provenance, SCITT and Sigstore for transparency. Section 10.4 gains an OMS row, and v0.2 gains a line item for an explicit OMS bundle reference in `model_identity` so a verifier can follow the chain from agent to model publisher instead of trusting an operator-asserted hash.
 
-**[SPEC]** **ADR-0011 accepted: the manifest envelope moves to COSE_Sign1** in spec v0.2, aligning with SCITT. The post-quantum profile is not a blocker, which was the main technical risk: [RFC 9964](https://www.rfc-editor.org/rfc/rfc9964.html) (Standards Track, May 2026) gives ML-DSA final IANA code points in COSE (ML-DSA-65 = `alg` -49, AKP key type 7). Migration is sequenced in five phases in the ADR and gated on manifest `version`, so v0.1 records keep verifying unchanged. Hybrid is the one construction COSE has no single answer for and is deferred to the v0.2 spec work.
+**[SPEC]** New **[ADR-0011](docs/adr/0011-signature-envelope.md): the manifest is a signed document, not a JWT/JOSE profile**, accepted. Answers the recurring "why not just a JWT extension?" question on precedent rather than on capability, steelmanning EAT ([RFC 9711](https://www.rfc-editor.org/rfc/rfc9711.html)) rather than dismissing it, and setting against it the choice every comparable multi-artifact provenance standard made: SCITT ([RFC 9943](https://www.rfc-editor.org/rfc/rfc9943.html)) mandates COSE_Sign1, DSSE rejected a JWS profile in writing, C2PA signs with `COSE_Sign1_Tagged`. The ADR also records a decision this project had never actually made: the envelope is neither JOSE nor COSE but a bespoke canonical-JSON detached signature, which carries both properties DSSE cites as reasons to avoid JWS while lacking a specification anyone else implements.
 
-**[SPEC]** New **ADR-0011: the manifest is a signed document, not a JWT/JOSE profile**. Answers the recurring "why not just a JWT extension?" question on precedent rather than on capability, steelmanning EAT ([RFC 9711](https://www.rfc-editor.org/rfc/rfc9711.html)) rather than dismissing it, and setting against it the choice every comparable multi-artifact provenance standard made: SCITT ([RFC 9943](https://www.rfc-editor.org/rfc/rfc9943.html)) mandates COSE_Sign1, DSSE rejected a JWS profile in writing, C2PA signs with `COSE_Sign1_Tagged`. The ADR also records a decision this project had never actually made: the envelope is neither JOSE nor COSE but a bespoke canonical-JSON detached signature. Migrating to COSE_Sign1 is recommended; Section 3.6 is unchanged until that is signed off.
+The accepted decision is that **the envelope moves to COSE_Sign1 in spec v0.2**. The post-quantum profile is not a blocker, which was the main technical risk: [RFC 9964](https://www.rfc-editor.org/rfc/rfc9964.html) (Standards Track, May 2026) gives ML-DSA final IANA code points in COSE (ML-DSA-65 = `alg` -49, AKP key type 7). Migration is sequenced in five phases and gated on the manifest `version` field, so v0.1 records keep verifying unchanged; tracked in [#243](https://github.com/agentrust-io/agent-manifest/issues/243). Hybrid is the one construction COSE has no single answer for and is deferred to the v0.2 spec work. Nothing in this release changes how a manifest is signed.
 
 **[SPEC]** Corrected three factual errors in the spec. Section 2.2 and Section 5 described the manifest signature as "JWS", which it has never been (there is no JOSE dependency in the SDK; the signature is a detached Ed25519 or ML-DSA-65 signature over an RFC 8785 pre-image). Section 10.4 cited EAT as RFC 9528, which is EDHOC; EAT is RFC 9711.
 

python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agent-manifest"
-version = "0.6.0"
+version = "0.6.1"
 description = "Agent Manifest SDK — cryptographically anchor all 10 artifacts defining an AI agent at deployment"
 readme = "README.md"
 requires-python = ">=3.11"