Repository navigation
fix(deps): replace trace update with aligned requirements and valid receipts - #4270
Ricky Gummadi (Ricky-G) wants to merge 1 commit into
Conversation
Preserve the Dependabot update from #4246, align the consolidated core runtime constraint, and omit absent optional transparency receipts for TRACE schema verification. Add real signing and dependency-alignment regressions. Signed-off-by: Microsoft Corporation <agentgovtoolkit@microsoft.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
github-actions
Bot
added
dependencies
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
📦 Dependency diff (SBOM)Comparing main → ricky-g-agentrust-trace-update. ✅ No dependency changes detected. |
|
Verified at 985fc10: the core runtime pin and the agent-mesh dev pin both move to agentrust-trace >=0.11.0,<0.12.0 (0.11.0 on PyPI since 2026-09-25, wheel checksum matches the description), the install hint follows, and the real fix is dropping the explicit transparency: None from both serializers. Reproduced the baseline: main's serializers against 0.11.0 fail the TRACE v0.2 schema (None is not of type string) in 5 tests, and sign_record does not validate, so main would emit unverifiable records; with this PR 36 pass, and the governance suite passes (173). The new tests cover real Ed25519 sign and verify, unpadded base64url, padding rejection, tamper rejection and pin alignment. sign_record and load_signing_key are unchanged in 0.11, so no enforcement_mode change is needed here. Scanners pass and CI is green. Same two items as on #4268 before I approve: the commit is signed off as Microsoft Corporation agentgovtoolkit@microsoft.com rather than a named person, and the AI Assistance attestations, the CLA box and the third IP box are unticked while the description says Copilot produced and submitted the change. Please tick them under your own name. One optional note: trace_model.py:104 and trace_sink.py:130 still pass transparency=None to TrustRecord while the dict omits it; a one-line comment that absence is intentional at Level 0 and 1 would keep the rationale the deleted comment carried. Once this merges, dependabot #4246 can be closed as superseded. |
This branch has not been deployed
2 participants
Related Issue
Replacement for #4246. Credit to Dependabot for the original dependency update, observed at
cdd2d11a5062dd91e8f20e8c4f168b379aa6039f. The original remains open pending maintainer verification of this replacement; this PR does not close it automatically.Problem & Solution
Summary
Preserve the requested
agentrust-trace>=0.11.0,<0.12.0update in agent-mesh'sdevextra, align the contradictory consolidated-core runtime requirement, and correct unanchored TRACE receipt serialization. Add real signed-record and requirement-alignment regressions without changing enforcement, trust, appraisal, software-only runtime, or SLSA defaults.Original failures and compatibility
The actual logs from CI run 37444908126 show
ResolutionImpossiblebefore tests run in agent-mesh Python 3.11/3.12/3.13, Engine API conformance, and docker-compose-test: mesh's updateddevextra requires TRACE 0.11 whileagent-governance-toolkit-corerequires<0.6.0. The core wheel force-includes the mesh implementation, so updating the core constraint is a tightly coupled installation fix, not a separate dependency upgrade.After resolving that conflict, an independent trusted-key verification regression found that the existing
transparency: nulloutput passes the Pydantic-only check but fails TRACE 0.11's JSON-schema verification. Both unanchored serializers now omit the optional absent receipt; no fake URI, broad null stripping, relaxed schema check, or trust fallback is introduced. The exported local dataclass remains unchanged. Neither serializer currently accepts an anchored receipt input.The integration calls
load_signing_key,sign_record, andTrustRecord.model_validatedirectly, not upstreamTraceAGTAdapterorTraceSandboxAdapter; their newly mandatoryenforcement_modeargument does not require an AGT API change. Real verification covers the emitted profile, trusted key, canonical unpadded signature, and tamper rejection.Changes
agent-governance-python/agent-mesh/pyproject.tomldevextra.agent-governance-python/agent-governance-toolkit-core/pyproject.tomlagent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.pyagent-governance-python/agent-mesh/src/agentmesh/governance/trace_model.pyagent-governance-python/agent-mesh/tests/governance/test_trace_sink.pyagent-governance-python/agent-mesh/tests/governance/test_trace_model.pyImpact on Your Work
Unblocks the approved independent replacement for the stuck dependency update while ensuring the upgraded dependency can actually verify AGT's emitted records. No unrelated packages or shared CI architecture are modified.
Timeline
None. Maintainer review and passing required checks are needed before merge. No merge or auto-merge has been requested by this child session.
Alternatives Considered
The one-line mesh-only update is unresolvable with the core requirement. Downgrading TRACE, disabling verification, inventing a receipt, removing the integration, or changing enforcement defaults would not preserve the requested update and were rejected. The chosen fixes are confined to the contradictory requirement and invalid optional-field representation.
Type of Change
Package(s) Affected
Core & runtime:
Governance & security:
Platform & tooling:
CLI plugins:
Shared / other:
Testing
Local environment: Windows, Python 3.14.7 in a session-specific virtual environment inheriting already installed dependencies; no shared-environment packages were changed. Local Python 3.11/3.12/3.13 were unavailable, so their results must come from this PR's CI. OPA 0.70.0 was downloaded from its official release and SHA256-verified; real ACS/OPA replay was required, not bypassed.
Unit Testing
Added four regressions: mesh/core requirement alignment with unchanged extra placement; the supported missing-dependency hint; persisted-record verification with a real generated test key plus padding/tamper refusal; and signing/verification of the other mapper. Updated two assertions to distinguish an absent optional receipt from an invalid null receipt.
Before the fix, the requirement/hint regressions failed against main, the original core wheel plus TRACE 0.11 reproduced
ResolutionImpossible, and the new verification regression failed specifically attransparency: None is not of type 'string'. These are observed failures, not inferred bot-specific problems.Manual Testing
In the commands below,
pythondenotes the session venv interpreter and$ais the session artifact directory. Package tests ran fromagent-governance-python/agent-mesh; other commands ran from the repository root. Source runs used checkout mesh/compliance/agt-policies source paths; the separate wheel integration run used the installed rebuilt core'sagentmeshpackage with no mesh source override.python -m pytest tests -q --tb=shortpython -m pytest tests/engine_api/conformance -q --cov=tests.engine_api.conformance.assertions --cov=tests.engine_api.conformance.conftest --cov=tests.engine_api.conformance.contract --cov=tests.engine_api.conformance.target --cov-report=term-missing --cov-fail-under=95 --tb=shortwithAGT_ENGINE_API_REQUIRE_REPLAY=1,ACS_OPA_PATHandPATHpointing to verified OPApython -m pytest agent-governance-python/agent-mesh/tests/governance/test_trace_sink.py agent-governance-python/agent-mesh/tests/governance/test_trace_model.py agent-governance-python/agent-mesh/tests/test_audit_reader_consistency.py -q --tb=shortpython -m build --wheel --no-isolation agent-governance-python/agent-governance-toolkit-core --outdir "$a/updated-wheels"python -m build --wheel --no-isolation agent-governance-python/agent-mesh --outdir "$a/updated-wheels"extra == 'dev'.python -m pip install --dry-run --no-build-isolation --report "$a/updated-resolver-report.json" "$a/updated-wheels/agent_governance_toolkit_core-5.0.0-py3-none-any.whl" "$a/updated-wheels/agentmesh_platform-5.0.0-py3-none-any.whl[dev]"--require-hashes.python -m pip checkpython -m ruff check agent-governance-python/agent-mesh/src --select E,F,W --ignore E501python -m ruff check agent-governance-python/agent-mesh/tests/governance/test_trace_sink.py agent-governance-python/agent-mesh/tests/governance/test_trace_model.py --select E,F,W --ignore E501python scripts/check_license_headers.py agent-governance-python/agent-mesh/src/agentmesh/governance/trace_sink.py agent-governance-python/agent-mesh/src/agentmesh/governance/trace_model.py agent-governance-python/agent-mesh/tests/governance/test_trace_sink.py agent-governance-python/agent-mesh/tests/governance/test_trace_model.pypython scripts/check_release_age.py --base origin/main --min-age-days 7 --explicit pypi:agentrust-trace@0.11.0python scripts/check_install_scripts.py --base origin/main --strict --max-deps 2000andpython scripts/check_build_hooks.py --base origin/main --strictpython -m pytest tests/ci/test_shared_dependency_contracts.py -qgit diff --checkSupply-chain evidence: TRACE 0.11.0 was uploaded to PyPI on 2026-09-25T23:30:00Z, is not yanked, and its wheel SHA256 is
7de621eaf795449e365d04967a82a551a18d75c99d248b4a0923f6d593bdb09e, matching the downloaded artifact. Its release tag resolves to commit7d8df347ada4ce84356640c9252ea2cc1d467b58. Reviewed the release notes/changelog and metadata delta: new direct transitivesreferencingandrfc3986-validator, raised minima forjsonschema,pydantic, andrfc8785; no GPL format extra was introduced. All newly installed remote resolver/build artifacts passed the seven-day rule, non-yanked check, and PyPI hash comparison before installation.Baseline findings, not hidden: the generic dependency-confusion CLI reports six false positives from existing
pip installprose comments in mesh's TOML (PR,brings,everything,needed,for,tests.), identically on main and this branch. Its manifest-awarecheck_pyproject_toml()passes for both changed manifests. Full default Ruff reports the same two pre-existingUP045annotations intrace_model.py; Black would reformat both existing test files on main as well. CI's E/F/W rules pass; unrelated formatting/scanner changes were not bundled.Docker Compose was not run locally. Its original failure was the same dependency conflict and is covered by resolver reproduction; actual Docker and Python-matrix results remain pending CI. This is not a claim that every repository test or required CI check has passed.
Checklist
Attribution & Prior Art
Prior art / related projects (if any):
Dependabot's #4246 supplies the original dependency-update intent. API compatibility was checked against agentrust-io/trace-spec v0.11.0 (Apache-2.0); no upstream implementation was vendored. This extends the existing ADR-0032 integration, not a new framework integration.
AI Assistance
If AI tools materially shaped this change, briefly note what was used:
GitHub Copilot performed the investigation, implementation, tests, and PR preparation under the user's explicit authorization. This PR was autonomously submitted for maintainer review; human review, CLA status, and the template's human attestations are not claimed. The commit includes the repository-required DCO signoff.
IP, Patents, and Licensing