Sourced from agent-manifest's releases.

python-v0.7.0

What's Changed

• feat(tee): share the validated DCAP v4 signature-section parse by @​imran-siddique in agentrust-io/agent-manifest#247
• spec(cose): specify the v0.2 COSE envelope (#243 phase 1) by @​imran-siddique in agentrust-io/agent-manifest#248
• chore(release): 0.7.0 by @​imran-siddique in agentrust-io/agent-manifest#249

Full Changelog: agentrust-io/agent-manifest@python-v0.6.1...python-v0.7.0

Sourced from agent-manifest's changelog.

[0.7.0] — 2026-07-27

Shares the hardware-validated TDX quote-signature parse so the sibling repos can stop carrying their own copies of the offsets, and specifies the v0.2 COSE envelope. No change to manifest signing or verification behaviour.

Added

[SPEC] COSE envelope specified for manifest version 0.2: https://github.com/agentrust-io/agent-manifest/blob/main/spec/agent-manifest-cose-envelope-v0.2.md, phase 1 of the ADR-0011 migration (#243). COSE_Sign1 (tag 18), or COSE_Sign (tag 98) with two signers for a hybrid Ed25519 + ML-DSA-65 signature so that both entries covering one payload is structural rather than an application rule. Protected header carries alg (-8 / -49, RFC 9053 and RFC 9964), kid, content type (3), and typ (16, RFC 9596); the payload is the RFC 8785 canonical JSON of the manifest, carried inline; the SCITT receipt attaches as receipts (unprotected label 394, RFC 9942 receipts). Media types application/agent-manifest+json (payload) and application/agent-manifest+cose (object), standards-tree, registration pending.

Three v0.1 mechanisms are deleted rather than ported, because each existed only to work around JSON having no defined place for post-signing data: the fixed signed_fields list and its coverage table, the hitl_record.approvals normalization rule, and the transparency_log_entry ordering rule. In v0.2 the payload is what is signed, and approvals, the attestation report, and the receipt all attach in the unprotected header. Hardware attestation binds sha256 of the payload bytes, so there is no longer a set of fields to exclude and keep in sync. No code changes; manifest version 0.1 is untouched and continues to verify under v0.1 section 3.6.

[SDK] parse_tdx_quote_signature() and TdxQuoteSignature expose the validated DCAP v4 signature-section parse (de-nested QE report, QE signature, auth data, PCK chain PEM) so sibling repos can delegate to it instead of reimplementing the offsets. Real quotes nest the QE material under a type-6 QE_REPORT_CERTIFICATION_DATA header; a flat parse reads the QE report six bytes early and rejects every genuine quote, which is what happened in cmcp and ca2a. verify_tdx_quote() now calls the shared parse, so there is one copy of the layout, and two regression tests pin the nested structure.

[0.6.1] — 2026-07-27

Closes a crash in verify_manifest() reachable from untrusted input on a default install, and settles the signature-envelope question for v0.2. No change to how manifests are signed or to any existing verification result.

Fixed

[SDK] verify_manifest() no longer raises on a post-quantum manifest when the pq extra is absent. pyoqs is optional, so on a default install any manifest declaring ML-DSA-65 or hybrid-Ed25519-ML-DSA-65 reached _require_oqs() and crashed the engine with an uncaught RuntimeError. Since a manifest is untrusted input, a verification endpoint would answer 500 to an attacker-supplied manifest rather than returning a verdict. _require_oqs() now raises AlgorithmUnavailableError (a RuntimeError subclass, so existing callers are unaffected), the engine catches it, records the reason as a warning, and returns UNVERIFIABLE. Not MISMATCH: the verifier has established nothing about a manifest that may be entirely valid, so accusing it of a defect would be wrong. An algorithm identifier outside the registry remains a MISMATCH, rejected by the schema enum before verification runs.

[SDK] A signature block with no algorithm field no longer falls back to Ed25519. The field is REQUIRED by spec 3.6 but sits outside the signing pre-image, and the verifier defaulted a missing identifier to the classical algorithm; it is now a signature.algorithm mismatch. Completes the 0.6.0 downgrade check, which only covered a present-but-weaker identifier.

Documentation

[SPEC] ADR-0005 amended after a spec-versus-implementation audit. Three of its statements did not match what shipped: it defined three crypto_profile values (standard, post_quantum, hybrid) where the spec and SDK define two (standard, post-quantum) with hybrid as a signature algorithm rather than a profile; it required the post-quantum profile at "Level 2 and above" where section 8.1 places it at Level 3; and it required an unsupported-algorithm verifier to "raise INCOMPATIBLE_VERSION", which is reserved for unsupported specification versions and is not something a verifier should raise at all. The original text is preserved per the ADR immutability rule, with an amendment section recording each correction. Section 4.2 now states the UNVERIFIABLE requirement normatively.

[SPEC] New section 10.5, SCITT profile mapping. Maps every structural piece of this specification to its RFC 9943 term (Artifact, Subject, Statement, Issuer, Signed Statement, Transparency Service, Receipt, Transparent Statement, Registration Policy, Auditor), which turns "agent-layer profile of SCITT" into a checkable claim and tells an implementer which parts are agent-specific (sections 3.2 to 3.5) and which are inherited. The section also states what the spec deliberately does not restate: OpenSSF Model Signing for the model artifact, SLSA and in-toto for build provenance, SCITT and Sigstore for transparency. Section 10.4 gains an OMS row, and v0.2 gains a line item for an explicit OMS bundle reference in model_identity so a verifier can follow the chain from agent to model publisher instead of trusting an operator-asserted hash.

[SPEC] New ADR-0011: the manifest is a signed document, not a JWT/JOSE profile, accepted. Answers the recurring "why not just a JWT extension?" question on precedent rather than on capability, steelmanning EAT (RFC 9711) rather than dismissing it, and setting against it the choice every comparable multi-artifact provenance standard made: SCITT (RFC 9943) mandates COSE_Sign1, DSSE rejected a JWS profile in writing, C2PA signs with COSE_Sign1_Tagged. The ADR also records a decision this project had never actually made: the envelope is neither JOSE nor COSE but a bespoke canonical-JSON detached signature, which carries both properties DSSE cites as reasons to avoid JWS while lacking a specification anyone else implements.

The accepted decision is that the envelope moves to COSE_Sign1 in spec v0.2. The post-quantum profile is not a blocker, which was the main technical risk: RFC 9964 (Standards Track, May 2026) gives ML-DSA final IANA code points in COSE (ML-DSA-65 = alg -49, AKP key type 7). Migration is sequenced in five phases and gated on the manifest version field, so v0.1 records keep verifying unchanged; tracked in #243. Hybrid is the one construction COSE has no single answer for and is deferred to the v0.2 spec work. Nothing in this release changes how a manifest is signed.

[SPEC] Corrected three factual errors in the spec. Section 2.2 and Section 5 described the manifest signature as "JWS", which it has never been (there is no JOSE dependency in the SDK; the signature is a detached Ed25519 or ML-DSA-65 signature over an RFC 8785 pre-image). Section 10.4 cited EAT as RFC 9528, which is EDHOC; EAT is RFC 9711.

[SPEC] Section 3.6 gained a normative algorithm-binding rule making the 0.6.0 verifier behaviour part of the specification: because the signature block sits outside the pre-image, a verifier MUST cross-check the declared algorithm against the signed crypto_profile, MUST reject a downgrade, and MUST reject an unrecognized algorithm identifier rather than defaulting to Ed25519. Section 10.4 adds rows for RFC 9711 and RFC 9943 positioning Agent Manifest as the agent-layer profile of the SCITT model.

[SDK] docs/index.md FAQ answers "why not specify it as a JWT or JOSE profile?" with the short form of the ADR-0011 argument.

[0.6.0] — 2026-07-26

Fixes the CLI that every document described but that nobody could run, and closes a signature-downgrade gap in the verifier.

Fixed

[SDK] The documented CLI invocation now works. Every command was nested under a redundant second manifest group, so the real invocation was manifest manifest verify signed.json while the README, the docs site, the PyPI description, and the CLI's own module docstring all printed manifest verify signed.json. Running the published quickstart failed at the first step with Error: No such command 'keygen'. tests/test_cli.py used the nested form, so CI never caught it. Commands are now attached to the top-level group as documented; the nested spelling still works, is hidden from --help, and prints a deprecation warning (removal in 1.0). test_documented_commands_are_top_level guards the surface.

[SDK] verify_manifest() now cross-checks the signed crypto_profile against signature.algorithm and fails closed on a downgrade (spec 4.2). crypto_profile is inside the signing pre-image, but the whole signature block is excluded from it (spec 3.6), so the algorithm identifier could previously be rewritten without disturbing the signed bytes: a manifest declaring the post-quantum profile verified VALID on a classical-only Ed25519 signature. The check runs independently of trusted_keys (the downgrade is a property of the manifest, not of the verifier's key material) and is one-directional: it rejects a signature weaker than the declared profile requires and permits a stronger one, so an issuer dual-signing ahead of the profile flip is not flagged. New conformance vector AM-VEC-020.

Documentation

... (truncated)

• 679b147 chore(release): 0.7.0 (#249)
• 5daff09 spec(cose): specify the v0.2 COSE envelope (#243 phase 1) (#248)
• 43a0e35 feat(tee): share the validated DCAP v4 signature-section parse (#247)
• 7661a77 chore(release): 0.6.1 (#246)
• 90cb08b fix(verify): return UNVERIFIABLE when an algorithm is unavailable (#245)
• 9bb965d docs(spec): map Agent Manifest onto SCITT terms (section 10.5) (#244)
• b7d6b7f chore(deps): bump actions/setup-python from 6 to 7 (#240)
• 023a349 chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#239)
• 7ce708e docs(adr): accept ADR-0011; envelope moves to COSE_Sign1 in v0.2 (#242)
• 84eb823 docs(adr): ADR-0011, the manifest is a signed document not a JWT/JOSE profile...
• Additional commits viewable in compare view