v0.4.0 — TRACE v0.2 conformance

Publishes the TRACE v0.2 conformance cutover.

Breaking: TR-ENV now requires the profile tag:agentrust-io.com,2026:trace-v0.2 and fails a record carrying the v0.1 identifier tag:agentrust.io,2026:trace-v0.1.

The v0.1 URI named agentrust.io, a domain this project never controlled. RFC 4151 permits a tag URI only where the minting authority controlled the named domain on the stated date, so the identifier was invalid rather than misspelled. See agentrust-io/trace-spec#107.

Cutover, not dual acceptance. A conformance suite that passed both identifiers would certify records minted under a domain we do not own, which is the thing being corrected.

If you still emit v0.1 records, stay on 0.3.x. To migrate: update the profile string and bump agentrust-trace to 0.5.0. Nothing else about the record format changed.

agentrust-trace-tests 0.3.0

Accept the azure-cvm-sev-snp platform in the conformance suite so Azure confidential-VM TRACE records pass verification.

v0.2.0

DID subject support; embedded signature verification for agentrust-trace sign_record() output; SLSA Level 0 and software-only platform at Level 0; private-key-leak detection in TR-SIG.

agentrust-trace-tests 0.1.0

First PyPI release of the TRACE conformance suite.

• TR-ENV / TR-SIG / TR-POL / TR-ANC / TR-RTE conformance modules
• Fail-closed signature verification: unsigned records cannot pass level >= 1
• Format detection from positive structural markers (no attacker-chosen downgrade)
• Configurable freshness max-age (24h default), https-only transparency and RIM references
• CLI: trace-tests verify --level {0,1,2}

Install: pip install agentrust-trace-tests