Repository navigation
Conversation
…#357) Signed-off-by: Srinivasa Dinakar Jainti <dinakarjs@gmail.com> Signed-off-by: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com>
…gentrust-io#365) Imran Siddique reproduced 0.2.0 on 2026-10-12, see the review on agentrust-io#295. The listing text predates that review. Signed-off-by: Thorsten Litzki <268185082+litzki-systems@users.noreply.github.com> Co-authored-by: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com>
…cal base64 signatures in openshell adapters (agentrust-io#371) - Require boolean capture_complete and integer 0 <= capture_start <= capture_end <= 2**53 - 1 in openshell.build_transcript. - Require canonical 64-byte base64 signatures in openshell_bundle.verify_bundle. Closes agentrust-io#368 Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com>
…JSON keys in _receipt_verify.py (agentrust-io#372) - Enforce canonical unpadded 64-byte base64url in _receipt_verify._b64url_decode. - Reject duplicate JSON object keys, NaN/Infinity constants, and non-object canonical_payload values in _receipt_verify._verify. Closes agentrust-io#367 Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com>
… and datetime reference_time in verify_aps_action_receipt (agentrust-io#381) Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com>
…guard non-dict fields in parmana_evidence (agentrust-io#382) Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com>
…rl, boolean Instant(now), and duplicate JSON keys (agentrust-io#383)
… steps (agentrust-io#397) * docs(pic-standard-mcp-guard): add exact fixed-lock reproduction steps Adds a reproduction procedure that installs from the committed hash-locked requirements, installs the integration with --no-deps, and states the expected pytest, record emission, and TRACE Level 0 verification output, for Verified-tier evaluation. Signed-off-by: Fabio Marcello Salvadori <fabio@madeinpluto.com> * docs(pic-standard-mcp-guard): make venv setup portable Signed-off-by: Fabio Marcello Salvadori <fabio@madeinpluto.com> --------- Signed-off-by: Fabio Marcello Salvadori <fabio@madeinpluto.com>
…gentrust-io#389) Updates the requirements on [weight-custody-manifest](https://github.com/agentrust-io/weight-custody-manifest) to permit the latest version. - [Release notes](https://github.com/agentrust-io/weight-custody-manifest/releases) - [Changelog](https://github.com/agentrust-io/weight-custody-manifest/blob/main/CHANGELOG.md) - [Commits](agentrust-io/weight-custody-manifest@v0.32.0...v0.33.1) --- updated-dependencies: - dependency-name: weight-custody-manifest dependency-version: 0.33.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…agentrust-io#393) Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@dc37677...7245906) Updates `github/codeql-action/init` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `github/codeql-action/autobuild` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-trace 0.11.0) (agentrust-io#355) Signed-off-by: Horizon <horizon@example.com> Co-authored-by: Horizon <horizon@example.com>
Preserve the author's offline appraisal and retained-evidence limits. Adoption companion for agentrust-io#399. Signed-off-by: Srinivasa Dinakar Jainti <dinakarjs@gmail.com> Signed-off-by: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com>
Owner
Author
|
Adoption is complete: upstream agentrust-io#399 now has the exact companion merge commit 4663734. The current package fetch/reproduction was rerun and recorded upstream. Closing this adoption companion as incorporated; upstream independent review and four UNMET external scenarios remain open. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adoption companion for agentrust-io#399, preserving original head 7d3960d and merging current main 7c01ee3. This is not a competing upstream implementation.
The original Proofable appraiser and fixtures are unchanged. The merge imports the already-reviewed mainline link/dependency/workflow baseline that the upstream review requested. The published tree 9cf9f99be127f6c9bec7cb31f0177d6204dff5cc equals the locally tested tree.
Validation: 60 root tests pass; all 50 manifests, compatibility and generated index/Marketplace catalog checks pass. In the declared hash-locked Python 3.12.14 environment, check_package.py passes both 54-test normal/-O selections and all 30 reference shapes against the 30 retained immutable public artifacts. The historical publisher checksum failure remains FAIL, the pinned positive dispatch appraisal is PASS, and all four scenarios remain UNMET. No vendor execution or protected target was invoked. Contribution-delta whitespace passes; the generated local test log was restored before constructing this tree.
Please adopt the signed merge commit 4663734 into the existing branch and run its hosted link and normal repository checks. A local source sync is not a hosted network crawl pass or an independent maintainer approval. Existing source history and evidence limits are preserved. DCO-signed; prepared with OpenAI Codex.