cA2A 0.2.0 — Developer Preview

cA2A 0.2.0 — Developer Preview

cA2A 0.2.0 is the first normal release of the Confidential Agent-to-Agent
profile and runtime. It is ready for evaluation through a standard install:

pip install ca2a-runtime

What ships

• A normative A2A extension profile for attenuated, holder-bound delegation.
• A live peer runtime that verifies delegation, intersects it with local Cedar
  policy, enforces the decision, and emits signed TRACE provenance.
• An attestation-gated sealed channel using X25519, HKDF-SHA256, and
  ChaCha20-Poly1305.
• Fail-closed SEV-SNP, Intel TDX, and TPM 2.0 appraisal, including validation
  against genuine Azure and GCP evidence.
• Mutual-attestation protocol support, an official a2a-sdk bridge, offline DAG
  verification, and a runnable MUST-level conformance suite.
• Startup-bound Agent Manifest identity. The runtime accepts v0.1 JSON and v0.2
  COSE manifests and refuses startup when configured node identity does not match
  the signed manifest.
• A rootless runtime container published as
  ghcr.io/agentrust-io/ca2a-runtime:v0.2.0 and latest, with keyless signing
  and build provenance.

Security hardening

• Delegation roots must be explicitly trusted; self-consistent attacker-minted
  roots are rejected.
• Holder proofs commit to every security-relevant request field, including the
  provenance parent link.
• Credential parsing rejects coercion, unknown fields, malformed encodings,
  invalid scopes, and ambiguous numeric representations.
• The reference HTTP boundary now bounds request bodies, timeouts, nonce length,
  UTF-8 decoding, and error responses.
• Release artifacts are built once, metadata-checked, installed and smoke-tested
  as both wheel and source distribution, then published through PyPI trusted
  publishing only when the release tag matches the package version.

Verification evidence

• 495 tests passed and 2 hardware-dependent tests skipped in the full local
  unit and conformance run.
• Python 3.11, 3.12, and 3.13 passed on Linux and Windows after merge.
• Ruff, formatting, mypy, Bandit, CodeQL, container build, benchmark, and strict
  governance verification passed.

Maturity and boundaries

This is a Developer Preview and may introduce breaking changes before 1.0.
Software mode is suitable for evaluation but carries no hardware assurance.
Before making production hardware claims, deployments must pin their own trust
roots and measurements. Mutual appraisal on independently operated real silicon,
fleet-wide TPM chain coverage, and published upstream A2A interoperability
results remain on the 1.0 path.

See ROADMAP.md,
LIMITATIONS.md,
and the full changelog.

Thanks to @Susanpdl, @joy7758, @10adnan75, @zohebk8s, @bytebackllc,
@carloshvp, and everyone who reviewed and tested this release.