python-v0.12.0

What's Changed

• ci: stop SBOM workflow pushing to protected main by @imran-siddique in #351
• fix(canonicalize): match RFC 8785 float formatting and UTF-16 key order by @rajnisht7 in #352
• docs(spec): require issuer key authorization by @litzki-systems in #367
• docs(spec): note Art. 50 runtime enforcement produces no attestable a… by @FaresMallouli in #366
• docs(spec): §3.5 clarify that approval_duration_seconds bounds the window, not the currency, of an approval by @ioanavalea in #355
• feat: add memory checkpoint behavioral assessment harness by @Knapp-Kevin in #369
• fix(attestation): reject expired certificates in hardware attestation chains by @rajnisht7 in #354
• fix(docs): resolve the standards-landscape diagram path, and check for it in CI by @imran-siddique in #371
• fix(transparency): fail closed on malformed Rekor responses by @altrudev in #359
• fix(tdx): bind verification to signed quote header by @altrudev in #374
• docs(examples): fix broken links to renamed/nonexistent spec and tutorial files by @rajnisht7 in #372
• fix(verify): negotiate version before current schema by @altrudev in #370
• fix(delegation): validate structure before interpretation by @altrudev in #357
• fix(delegation): bound child scope_grant ttl_seconds by absolute expiry by @rajnisht7 in #353
• feat(ci): vouch first-time contributors, and say the rule about understanding by @imran-siddique in #381
• test(tdx): run the committed real-hardware capture in CI by @imran-siddique in #382
• fix(security): pin all 35 third-party action refs to commit SHAs by @imran-siddique in #385
• fix(verify): make the verifier fail closed on attestation, timestamps and AK chains by @imran-siddique in #386
• fix(hitl): bind approval_method into the approval signature pre-image by @imran-siddique in #387
• fix(verify): stop a nested omission masking the full-binding requirement by @imran-siddique in #388
• fix(cert-chain): enforce pathLenConstraint (RFC 5280 §4.2.1.9) by @rajnisht7 in #384
• fix(trace): manifest binding can raise on malformed nested manifest shapes by @kingztech2019 in #380
• fix(plugins): verify_plugin_manifest_reference reads source_bundle before structural verification by @kingztech2019 in #379
• docs: make first manifest checks reproducible and clarify evidence by @imran-siddique in #389
• release: agent-manifest 0.12.0 by @imran-siddique in #390

New Contributors

• @FaresMallouli made their first contribution in #366
• @ioanavalea made their first contribution in #355
• @Knapp-Kevin made their first contribution in #369
• @altrudev made their first contribution in #359
• @kingztech2019 made their first contribution in #380

Full Changelog: python-v0.11.2...python-v0.12.0