v0.14.1

Bug fixes

• Made the loopback demo ignore proxy environment variables. It now stays local even when a
  corporate proxy is configured without a localhost exception; normal agent runs remain
  proxy-aware.

Documentation

• Linked the uv installation instructions and updated the Action example to v0.14.1.

Maintenance

• Changed the release workflow to prepare a titled draft with assets after PyPI publication, so
  Marketplace metadata and categories can be reviewed before publishing. CONTRIBUTING documents
  the manual step.
• Kept the live proxy regression in normal CI but outside mutmut's instrumented test selection;
  the new runner path kills all four of its generated mutants.

v0.14.0

Security

• Made the first-party Action execute the source selected by its reference with the committed
  uv.lock, a pinned setup-uv revision, and an explicit uv version. The contract path crosses
  the composite Action boundary through an environment variable and remains a quoted argument
  rather than shell input. An option terminator prevents option-like filenames from changing CLI
  behavior.
• Kept CI evidence opt-in. The Action neither uploads response data nor requests write
  permissions, leaving potentially sensitive artifacts under the caller's explicit control.

Features

• Added a root composite GitHub Action that runs a2a-proof.yaml as a behavioral CI check. Its
  single optional config input selects a non-default contract; advanced controls remain in the
  CLI.
• Added a2a-proof demo, which starts a deterministic loopback agent and performs an A2A JSON-RPC
  exchange without keys or an external service. It checks state, structured data, file size, and
  SHA-256; --fail demonstrates diagnostics and exit code 1.

Documentation

• Added the local demo and minimal Action invocation to the README, while keeping complete
  workflow, security, evidence, and advanced-option guidance in the operations guide.

Maintenance

• Added a CI consumer for the repository's own Action. It starts the demo agent on an ephemeral
  port and runs the environment-backed contract through the locked Action runtime.
• Added CLI and live protocol coverage for both successful and intentionally failing demo paths.
• Established a clean core mutation baseline: 4,405 of 4,579 mutants are killed (96.20%). Four
  timeouts remain in the bounded push wait, listener, and socket-read mutations; all other abnormal
  statuses are zero. The threaded demo agent stays under live and negative protocol tests because
  mutating its request handlers destabilizes the in-process mutation collector.

v0.13.0

Security

• Bound every task-subscription event to the task ID and context returned by the preceding turn.
  A stream that crosses task or context boundaries now fails before its content reaches assertions,
  reports, or evidence.
• Kept file-content verification local and bounded. SHA-256 is computed only for inline raw parts;
  remote URLs are never fetched, and computed digests and bytes are excluded from reports and
  evidence.

Features

• Added action: subscribe for black-box SubscribeToTask contracts. A scenario can accept an
  active task, resume its stream, and apply existing state-trajectory, text, data, file, AP2,
  timing, and invariant checks to the completed subscription result.
• Required the subscription to start with the current task snapshot and finish in a terminal or
  interrupted state, matching the A2A 1.0 lifecycle contract across JSON-RPC, HTTP+JSON, and gRPC.
• Added exact size_bytes, inclusive min_size_bytes and max_size_bytes, and sha256 assertions
  for inline raw file parts. Exact size and range predicates are mutually exclusive, and content
  checks explicitly require kind: raw.

Documentation

• Added a focused stream-resumption contract to the lifecycle guide and documented file-integrity
  syntax, validation rules, and the passive treatment of remote URL parts.
• Updated the README capability map to surface stream resumption and file integrity without
  expanding the onboarding path.

Maintenance

• Added real JSON-RPC, HTTP+JSON, and gRPC subscription exchanges through the official A2A Python
  SDK, including task continuity, artifact collection, terminal state, timing, and digest checks.
• Extended runner, configuration, generated schema, protocol rejection, serialization, and
  assertion coverage while retaining the 99% coverage gate.
• Established a clean mutation baseline: 4,406 of 4,579 mutants are killed (96.22%), with no
  survivors in the v0.13 subscription or file-integrity paths. The three timeouts remain in the
  bounded push receiver's listener and socket-read mutations.

v0.12.0

Features

• Added --transport to run and diff, allowing one contract to exercise JSON-RPC, HTTP+JSON,
  and gRPC without editing or duplicating its YAML. Evidence manifests record the requested
  transport mode, including auto.

Documentation

• Added concise, reproducible showcases for the official Python, Go, and Rust SDK agents plus an
  independent Turul multi-turn agent. The examples cover routed discovery, all three A2A bindings,
  task cancellation, and same-task input_required continuation.
• Updated the project comparison to distinguish application behavior contracts from the official
  A2A ITK's SDK interoperability matrix.

Maintenance

• Validate every checked-in example configuration offline in CI. Live upstream agents remain
  opt-in so external networks, compilers, and repository drift cannot make normal builds flaky.
• Established a clean mutation baseline: 4,234 of 4,406 mutants are killed (96.10%), with no
  uncovered, suspicious, skipped, interrupted, or crashed mutations. The four timeouts are known
  bounded-concurrency and socket-read mutations.

v0.11.0

Security

• Added an authenticated, bounded push callback receiver with a unique route and high-entropy token
  for every trial. It accepts standard Bearer authentication plus the legacy token header emitted
  by A2A Python SDK 1.1.1. Accepted events are bound to the task and context returned by the initial
  A2A request, exact retries are deduplicated, and public callback URLs require HTTPS. Plain HTTP is
  limited to loopback and private-network hosts.
• Limited callback concurrency, active subscriptions, request and aggregate body sizes, event
  counts, path length, and connection lifetime. Malformed requests, ambiguous headers, unsupported
  media types, and unknown protobuf fields are rejected before evaluation.

Bug fixes

• Rejected callbacks that omit the expected context ID, and canceled active connection handlers
  when the receiver closes so no accepted request outlives the run.
• Closed a newly registered callback subscription when message sending, file preparation, task-ID
  validation, or binding fails, preventing failed trials from consuming the run-wide subscription
  limit.
• Started the await_push timeout when the wait action begins instead of when the callback was
  registered, and surfaced authenticated invalid deliveries immediately instead of waiting for a
  timeout.

Features

• Added black-box push delivery contracts. A turn can register an inline A2A push configuration,
  return its task immediately, and use action: await_push to assert the state trajectory, text,
  structured data, files, timing, AP2 proofs, and global invariants of the delivered events.
• Added a loopback callback listener for local agents and explicit listen_host, listen_port, and
  public_url settings for remote agents behind an HTTPS reverse proxy or tunnel.

Documentation

• Replaced the README's toy capital-city example with a realistic structured routing contract and
  a compact risk-to-capability map covering behavioral drift, nondeterminism, lifecycle, deployment
  comparison, leak detection, and AP2 verification.
• Added a focused push notification guide covering local and remote setup, callback routing,
  authentication, lifecycle rules, bounds, and failure behavior without expanding the README into
  a reference manual.

Maintenance

• Added real JSON-RPC and HTTP+JSON push exchanges plus an interoperability test that delivers an
  event through the official A2A Python SDK sender. Extended configuration, protocol rejection,
  cleanup, schema, and runner coverage while retaining the 99% coverage gate.
• Added the lightweight HTTP/1.1 parser as a direct dependency and included the callback receiver
  in deterministic mutation testing.

v0.10.0

Security

• Added signed AP2 payment and checkout receipt verification with an exact ES256 protected-header
  requirement, official AP2 success/error payload validation, and explicit local public P-256
  issuer keys. Remote key discovery, private JWK material, and token-supplied trust remain rejected.
• Bound every response receipt to a mandate assertion that passed full chain verification in the
  same turn. The receipt reference is recomputed from that exact closed-mandate JWT instead of
  trusting a caller-provided response field.
• Redacted selected receipt JWTs before reports and evidence are produced. Offline inspection reads
  bounded files or standard input, never accepts token values as arguments, and does not expose
  mismatched signed fields in diagnostics.

Features

• Added kind: receipt AP2 contract assertions for payment and checkout receipts. Contracts can
  check issuer, success or error status, payment or order identifiers, and error codes while using
  binds_to to reference a named mandate assertion.
• Added a2a-proof ap2 inspect-receipt with concise terminal and stable JSON output. It can derive
  the expected reference from a mandate file or accept an already known reference hash.
• Extended the generated JSON Schema with receipt assertions, binding identifiers, path and
  response-part filters, and type-specific validation.

Bug fixes

• Made official receipt tampering tests flip a decoded signature bit instead of a trailing
  base64url character whose unused padding bits could leave the signature unchanged.

Documentation

• Expanded the focused AP2 guide with a complete mandate-to-receipt contract, trust boundary, CLI
  walkthrough, exact output, exit semantics, and copyable success-path example.
• Updated the README feature summary and documentation links without expanding the onboarding
  path.

Maintenance

• Added synthetic payment-receipt fixtures signed by discarded demo keys and official AP2 v0.2.0
  integration tests for payment and checkout receipts, success and error payloads, signature
  tampering, and mandate-reference binding.
• Extended unit, schema, CLI, reporting, configuration, redaction, and negative-path coverage while
  retaining complete statement and branch coverage.
• Established a clean mutation baseline after removing the generated mutants/ tree: 3,617 of
  3,697 mutants are killed (97.84%), with no uncovered, suspicious, skipped, timed-out, or crashed
  mutations. Surviving receipt mutants were triaged for observable contract and security impact.

v0.9.0

Security

• Added offline AP2 mandate inspection without accepting tokens as command-line values. Tokens are
  read from a bounded file or standard input, never echoed, and omitted from success and failure
  output.
• Rendered verified mandate fields as literal, bounded text so terminal control characters and
  Rich markup cannot alter inspector output. Trust roots remain local public P-256 JWKs; remote key
  discovery and private JWK material remain rejected.
• Split invalid mandates from setup failures: cryptographic, delegation, audience, nonce, validity,
  schema, constraint, and checkout-binding failures return exit code 1; input, key, and missing
  SDK errors return 2.

Features

• Added a2a-proof ap2 inspect with automatic payment or checkout type detection, optional
  type-specific expected bindings, concise terminal output, and stable JSON output.
• Added verified summaries for payment payee, amount, transaction, and instrument type, plus
  checkout merchant, status, currency, item count, and signed checkout hash. Raw mandate tokens and
  payment instrument identifiers are not reported.

Documentation

• Added a copyable inspector walkthrough with the exact terminal result, stdin usage, JSON mode,
  and exit-code contract while keeping AP2 reference material outside the README.

Maintenance

• Added a synthetic signed AP2 payment fixture whose private demo keys were discarded. CI verifies
  the documented command against the pinned official AP2 v0.2.0 SDK.
• Extended official integration coverage to inspect real payment and checkout chains and reject a
  tampered signature through the same verifier used by response contracts.
• Strengthened AP2 and cross-module contract tests; a clean full mutation run now kills 3,108 of
  3,138 mutants (99.04%) with no uncovered, suspicious, timed-out, or crashed mutations.

v0.8.0

Security

• Added cryptographic verification for AP2 v0.2.0 dSD-JWT mandate chains, including every
  delegation signature and binding, terminal audience and nonce, validity windows, typed payloads,
  and open-to-closed constraints.
• Required an explicit local public P-256 trust root. Key paths are confined to the contract
  directory, private JWK material is rejected, reads are bounded, and remote key discovery is never
  attempted.
• Redacted mandate tokens selected by AP2 assertions before JSON, JUnit, terminal, or evidence
  output while preserving unrelated response data. Verification failures do not echo untrusted
  token payloads.

Features

• Added expect.ap2 assertions for signed payment and checkout mandate chains. Official AP2 data
  keys are inferred from the mandate type, with optional response-part filters and custom JSON
  Pointer paths.
• Added payment checks for expected transaction IDs and open-checkout references, plus checkout
  checks for expected hashes and automatic binding of checkout_hash to the signed
  checkout_jwt.

Documentation

• Added a focused AP2 guide covering the pinned official SDK install, trust-root setup, payment and
  checkout examples, verification semantics, redaction, and current protocol boundary.

Maintenance

• Added a pinned CI integration test against the official AP2 v0.2.0 source commit. It creates
  valid payment and checkout chains, verifies both, and rejects a tampered signature.
• Confirmed real interoperability between the current A2A client and an AP2-style A2A 0.3.24
  JSON-RPC server, including legacy extension-header translation and signed mandate transport.
• Extended the generated configuration schema and deterministic mutation target for AP2 while
  retaining complete statement and branch coverage.

v0.7.0

Features

• Added black-box cancellation contracts. A multi-turn scenario can request an initial
  non-terminal task with return_immediately: true, invoke the protocol-level cancel operation,
  and assert the returned task state, content, timing, files, data, and invariants.
• Added task persistence contracts through action: get_task, with optional bounded
  history_length. Task IDs and contexts flow between message, cancel, and retrieval turns without
  exposing transport-specific methods in the configuration.
• Added a2a-proof diff --against URL for running one selected contract against baseline and
  candidate deployments. Terminal and JSON output classify Agent Card and scenario outcomes as
  regressions, improvements, changed, or unchanged; the candidate contract result controls the
  exit status.
• Kept lifecycle behavior portable across JSON-RPC, HTTP+JSON, and gRPC. Streaming agents use a
  dedicated non-streaming client for the A2A return_immediately request while normal scenarios
  retain streaming state trajectories and first-event timing.

Security

• Applied the existing URL credential rejection, Agent Card origin checks, redirect policy,
  request headers, extensions, response bounds, and timeouts to lifecycle and candidate diff runs.
• Kept differential comparison at the contract-result layer instead of fetching or comparing
  untrusted remote resources; response file URLs remain passive and omitted from reports.

Documentation

• Added a complete cancellation-and-persistence contract and documented lifecycle ordering,
  missing-task behavior, history limits, diff classifications, and diff exit codes.
• Kept the README focused on first use and moved contract, assertion, lifecycle, and operational
  reference material into short topic guides.

Maintenance

• Added real lifecycle exchanges for every supported transport and a real CLI deployment diff;
  272 tests retain complete statement and branch coverage across the expanded surface.
• Added lifecycle configuration constraints to the generated JSON Schema and differential result
  classification to mutation testing, with 98.8% of 2,362 mutants killed.

v0.6.0

Security

• Kept invariant secrets out of YAML and reports by accepting environment variable names,
  resolving their values only in memory, and redacting values case-insensitively before evidence
  truncation or serialization.
• Removed response text, structured data, and file metadata from every report when a global
  invariant detects a leak in that turn.
• Redacted resolved request-header values and their environment substitutions throughout evidence
  records, and continued to omit remote file URLs. Evidence output is limited to 100 failed trials
  and bounded response previews.
• Wrote evidence through a private temporary directory with flushed files and an atomic final
  rename; existing destinations are never overwritten.

Bug fixes

• Made JUnit agree with pass_rate: failed trials within the accepted budget are now reported as
  skipped instead of failing an otherwise successful CI report.
• Made an explicitly empty environment mapping remain empty instead of silently falling back to
  the process environment during configuration loading.

Features

• Added suite-wide response invariants for forbidden text and environment-backed secret values.
  They run on every response turn and identify the violated rule without printing the secret.
• Added --evidence DIR for atomic, machine-readable run bundles. Each bundle records the contract
  and Agent Card hashes, run metadata, failed-trial summaries, and a normalized response trace in
  JSONL. Agent Card and aggregate latency failures are included even when no trial fails.
• Added scenario-level p50_seconds and p95_seconds latency contracts across completed trials,
  with aggregate results in terminal, JSON, and JUnit reports.
• Added opt-in --jobs concurrency for repeated trials. Concurrency is bounded at 32, remains
  sequential by default, and preserves deterministic result ordering.

Documentation

• Documented global invariants, evidence contents and limits, percentile semantics, and safe
  parallel trial execution.

Maintenance

• Added evidence handling to mutation testing and extended the generated configuration schema for
  invariants and aggregate latency contracts.