build(deps): bump agentrust-trace from 0.5.1 to 0.9.0 in /integrations/ramen-ai-cmcp

[dependabot]

Bumps agentrust-trace from 0.5.1 to 0.9.0.

Release notes

Sourced from agentrust-trace's releases.

TRACE SDK 0.8.0

MCP Server Provenance Records

A signed statement about an MCP server: what it is, what tools it exposes, who is saying so, and how much that is worth. Specification: spec/server-provenance-v1.md.

cMCP enforces policy at the call boundary and can say nothing about whether the server on the other end is what it claims. Its catalog answers that locally, with approved definitions and a pinned TLS fingerprint, but all of it is operator-asserted: nothing one operator learns is usable by the next.

from agentrust_trace.provenance import build_record, sign_record, verify_record, check_tool_catalog

check_tool_catalog() is a separate call, on purpose

Verifying the signature proves a document is internally consistent and signed by a key you trust. That is exactly what an attacker holding a stolen publisher key produces. What they cannot do is make the server in front of you offer the tools their record describes.

That comparison needs something verify_record() structurally does not have — what the server said to you — so it is its own call, with its own exception type, so a consumer can tell "bad document" from "wrong server".

Assurance is a closed set

publisher-asserted, observer-attested, tee-attested. The interesting fact about a provenance record is never that it exists but who is asserting it, and a verifier MUST NOT read absence as any of them.

Identity is artifact, endpoint, or both

A URL is the obvious handle and the worst candidate: it moves, it is per-deployment, and two operators running the same server produce different ones. artifact.digest covers the entrypoint rather than the interpreter — every interpreted server on a host shares one interpreter digest, so a pin over it matches a completely different server. endpoint.spki_sha256 digests the public key rather than the certificate, so identity survives renewal.

Out of scope, and it says so

Key distribution for publisher (a PKI question this format would only pretend to answer), whether a server is any good (the moment a provenance format scores servers, its publisher becomes the party everyone must trust), and what the code does at runtime.

Full detail in CHANGELOG.md.

TRACE SDK 0.7.0

origin: who assembled this record, when it was not the runtime that ran

runtime.platform: "software-only" was the honest value in two situations that are not the same claim. A dev-mode record is unattested because nothing attested it. A record transcribed from a third-party control plane is unattested because the party asserting the evidence also wrote the log. A consumer weighing a record could not tell those apart from platform alone.

"origin": {
  "kind": "third-party-control-plane",
  "producer": "vendor-gateway/2.1",
  "source_event_id": "evt-7f3a",
  "ingested_at": 1760000000
}

Optional and additive, under the same v0.2 profile URI, following the delegation precedent from 0.4.0. Existing records stay valid and absence means self, so every hardware profile in the spec is unaffected.

kind is a closed set (self, third-party-control-plane, log-import) rather than free text, because the entire value of the field is that a verifier can key on it.

The rule that makes it worth having

... (truncated)

Changelog

Sourced from agentrust-trace's changelog.

[0.9.0] — 2026-08-09

Documentation

• The security policy now describes the software that is actually released. It puts the Python signing and verification APIs, schemas, adapters, packaging, and release automation in scope; lists TRACE v0.2 and agentrust-trace 0.x as supported; and marks the superseded v0.1 profile unsupported.

[0.9.0] — 2026-08-09

Added

• spec/content-marking-v1.md and agentrust_trace.content_marking: bind a marked asset to the execution that produced it. EU AI Act Article 50(2) and 50(4) have been in force since 2 August 2026 and are the only AI Act obligations that bite this year. One C2PA assertion, com.agentrust-io.trace, carries a hashed reference to the Trust Record for the execution that produced the asset.

  The document opens with what this does not do, because the temptation to overclaim here is strong. It does not stop anyone stripping the mark: removing a C2PA manifest from a file is trivial and nothing here changes that. It is not watermarking. It does not make a deployment compliant. What it buys is narrower and real: a mark that is present becomes checkable against a hardware-rooted claim instead of being an unverifiable label, and in a channel that requires marks an absent one is detectable.

  Three separate things must be checked and the assertion merges none of them: the C2PA signature says the assertion was in the manifest when the asset was signed, the TRACE signature says the execution happened as described, and the hash says the record being pointed at is the one the signer meant. A verifier that checks one of the three has checked a third.

  build_assertion() takes the exact bytes that will be served rather than a record object, because a hash over a re-serialized dict is a hash of bytes nobody will fetch; a test pins that indent=2 alone breaks the binding. verify_assertion() has no signature-only path: record_bytes is a required parameter, since an assertion whose hash was never checked is a URL in a file.

  17 tests.

Added

• enforcement_mode: "declared". The three existing modes all assert that something evaluated the policy: enforce acted on the result, advisory did not, silent acted with the log lines suppressed. declared asserts less — the policy is named and bound into the signed record, and nothing evaluated it.

  That is not a corner case, it is the common one. An agent framework has no policy engine, so a record built by observing a LangChain or LlamaIndex run has a policy the operator declares and no evaluation of it anywhere. With three values, such a record had to claim an evaluation that never happened; both framework adapters refused to default the field and documented the overstatement instead, which is honest and still leaves every framework record marginally untrue.

  declared is the weakest value and is never a default. A producer that evaluates policy MUST NOT use it, and a consumer MUST NOT read it as evidence that any rule was checked. A verifier appraising for enforcement SHOULD treat it as it treats an absent enforcement claim.

  Additive to a closed enum in both the model and the JSON schema, so unknown values are still rejected. Same one-directional consequence as origin: a verifier older than this release rejects a record carrying declared.

[0.8.0] — 2026-08-09

Added

• agentrust_trace.provenance: build, sign and verify MCP Server Provenance Records. Step 2 of the sequence, implementing spec/server-provenance-v1.md. In the SDK rather than in cMCP, so a publisher can produce a record without adopting a runtime, which is the only way the format reaches an ecosystem that will not adopt one.

  check_tool_catalog() is a separate call on purpose. Verifying the signature proves a document is internally consistent and signed by a key you trust, which is exactly what an attacker holding a stolen publisher key can produce. What they cannot do is make the server in front of you offer the tools their record describes. That comparison needs something verify_record() does not have — what the server said to you — so it is its own obvious call rather than a flag, and it raises its own exception type so a consumer can tell "bad document" from "wrong server".

  The builder refuses records that cannot mean anything: an identity with neither artifact nor endpoint, a tee-attested record with no evidence, evidence attached to a kind that does not claim it (a reader would take it as an attestation that was made), a publisher that is a display name rather than a resolvable DID or SPIFFE URI, and an endpoint URL with no key digest, since a URL alone is not an identity.

  verify_record() requires a trusted key and never takes one from the record. Verifying a document against a key it supplies proves only that it is internally consistent, which is what a forgery is.

  24 tests, including the one the format exists for: a perfectly valid signature over a description of a different server still fails the catalog check.

Added

• spec/server-provenance-v1.md: a signed statement about an MCP server. cMCP enforces policy at the call boundary and can say nothing about whether the server on the other end is what it claims. Its catalog answers that locally — approved definitions, a measured catalog hash, a pinned TLS fingerprint — but every part of that is operator-asserted, so nothing one operator learns is usable by the next.

  The format carries the same shape of honesty as the origin block: a closed kind (publisher-asserted, observer-attested, tee-attested) because the interesting fact is never that provenance exists but who is asserting it, and an explicit rule that a verifier MUST NOT treat absence as any of them.

... (truncated)

Commits

• 94271a1 chore(release): 0.9.0 (#145)
• 7be497c spec: bind synthetic-content marking to the execution that produced it (#144)
• 1bd0877 feat(spec): enforcement_mode gains "declared", for policy nothing evaluated (...
• 671f2a8 chore(release): 0.8.0 (#141)
• 14ff6b8 feat(provenance): build, sign and verify server provenance records (#140)
• c83e029 spec: a signed statement about an MCP server, and what it is not (#139)
• 618f544 fix(fixtures): give the Acta set a policy digest that is actually current (#137)
• b2dc00d fix(schema): resync the packaged copy, and make the next drift fail (#136)
• 1794b61 feat(spec): add the optional origin block, and stop software-only meaning two...
• fd311de docs(spec): publish the registry anchor and inclusion-proof format (#111) (#134)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[imran-siddique]

Reviewed the pinned TRACE SDK update. The cMCP conformance matrix covers Python 3.11-3.14, and CodeQL/validation passed on the prior head; approving the refreshed current head for CI re-evaluation.

[imran-siddique]

Re-approved after refreshing onto main at current head c60c07d; the dependency diff is unchanged. Waiting for the exact-head conformance, validation, and CodeQL reruns before merge.