fix(deps): bump every trace pin to the v0.2 cutover - #61
Merged
Conversation
The profile-URI PR bumped only the two dependency files an earlier grep
surfaced, because that grep was truncated with head -3. Nine more
declarations still pinned the pre-cutover releases, including two exact
pins in plugins/agentrust-codex/requirements.txt.
The result was a producer emitting v0.2 records against a conformance
suite that still required v0.1, which is exactly the mismatch the cutover
sequencing was supposed to avoid. It failed on main as:
TR-ENV FAIL eat_profile must be 'tag:agentrust.io,2026:trace-v0.1',
got 'tag:agentrust-io.com,2026:trace-v0.2'
Every declaration now names 0.5.0 / 0.4.0, including the integration.yaml
manifests, which are documentation of what an integration was validated
against rather than installed pins, and were also stale.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes
agentrust-codex testsfailing on main after #60.What I got wrong
#60 bumped only two dependency files, because the grep I used to find them was truncated with
head -3. Nine more declarations still pinned pre-cutover releases, including exact pins inplugins/agentrust-codex/requirements.txt(agentrust-trace==0.3.0,agentrust-trace-tests==0.2.0).So the codex plugin emitted v0.2 records against a conformance suite that still required v0.1 — precisely the producer/verifier mismatch the cutover sequencing exists to prevent. On main it failed as:
I also merged #60 while a second wave of checks was still pending, having watched only the conformance jobs. Had I waited, this would have been caught before main went red rather than after.
What changed
Every remaining declaration moves to
agentrust-trace0.5.0 /agentrust-trace-tests0.4.0:plugins/agentrust-codex/requirements.txt(the two exact pins that broke CI)scheduled-agents/requirements.txt,integrations/sentinel/requirements-dev.txtintegration.yamlmanifests, which document what each integration was validated against rather than installing anything, and were stale in their own right (comply54 still said 0.1.0).github/workflows/spendguard-conformance.ymlinstalls unpinned, so it picks up the current releases and needs no change.This time I scanned without truncating, across
*.txt,*.toml,*.yaml,*.yml, and*.md.