fix(contract): align wire spec_version with spec/VERSION before first publish

CHANGELOG.md

@@ -23,5 +23,5 @@
   cross-language JSON behavior.
 - Add the pre-alpha TypeScript reference SDK and shared conformance gates.
 
-- Initial `0.1.0-dev` event contract and conformance fixtures.
+- Initial `0.1.0-alpha.1` event contract and conformance fixtures.
 - Initial Python reference SDK with schema/privacy validation and OTel span-event projection.

LIMITATIONS.md

@@ -1,6 +1,6 @@
 # Limitations
 
-Current `0.1.0-dev` limitations:
+Current `0.1.0-alpha.1` limitations:
 
 - The contract and SDK are experimental and may change incompatibly.
 - A Python reference SDK and a TypeScript reference SDK (`packages/typescript/`)

SECURITY.md

@@ -26,7 +26,7 @@ Include the affected contract/SDK version, an executable reproducer where safe,
 
 ## Supported versions
 
-No stable release exists. Only the latest `0.1.0-dev` revision will receive fixes until the first published release.
+No stable release exists. Only the latest `0.1.0-alpha.1` revision will receive fixes until the first published release.
 
 ## Runtime boundary
 

compatibility/golden/event-factory.json

@@ -1 +1 @@
-{"agent_id":"agent-1","event_id":"018f0f7d-7a13-7cc2-8000-000000000042","event_type":"usage.recorded","input_tokens":7,"operation":"chat","producer":{"name":"parity-test","version":"1.0.0"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":"1787079000000000000","workflow_id":"workflow-1"}
+{"agent_id":"agent-1","event_id":"018f0f7d-7a13-7cc2-8000-000000000042","event_type":"usage.recorded","input_tokens":7,"operation":"chat","producer":{"name":"parity-test","version":"1.0.0"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079000000000000","workflow_id":"workflow-1"}

compatibility/golden/evidence-chain.json

@@ -6,13 +6,13 @@
       "fixture": "policy-decision.json",
       "sequence": 0,
       "previous_digest": null,
-      "digest": "f31be297b83550f55b569e75036a83b23a239d45965a46c40a589fd48ab30b74"
+      "digest": "edb9fe3860da8adeb7ee05d80696b83a15d77f019613fa6115a494907932929e"
     },
     {
       "fixture": "usage.json",
       "sequence": 1,
-      "previous_digest": "f31be297b83550f55b569e75036a83b23a239d45965a46c40a589fd48ab30b74",
-      "digest": "dab5451eefd004d6616e489a8ce093c9c794b64222219ce9f0d69b30f9ca1021"
+      "previous_digest": "edb9fe3860da8adeb7ee05d80696b83a15d77f019613fa6115a494907932929e",
+      "digest": "3d22af74587efb5d90c61a8a0ed26fefc6b0936ad1726e28cd70dffcf3d7984b"
     }
   ]
 }

conformance/fixtures/invalid/action-without-digest.json

@@ -1,5 +1,5 @@
 {
-  "spec_version": "0.1.0-dev",
+  "spec_version": "0.1.0-alpha.1",
   "event_id": "018f0f7d-7a13-7cc2-8000-000000000096",
   "event_type": "action.executed",
   "time_unix_nano": "1787079650000000000",

conformance/fixtures/invalid/aggregate-cost-without-rollup.json

@@ -1 +1 @@
-{"agent_id":"agent-1","cost":{"amount":1,"currency":"USD","source":"aggregate"},"event_id":"018f0f7d-7a13-7cc2-8000-000000000009","event_type":"usage.recorded","operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":"1"}
+{"agent_id":"agent-1","cost":{"amount":1,"currency":"USD","source":"aggregate"},"event_id":"018f0f7d-7a13-7cc2-8000-000000000009","event_type":"usage.recorded","operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":"1"}

conformance/fixtures/invalid/model-call-with-rollup.json

@@ -1 +1 @@
-{"agent_id":"agent-1","aggregation":{"cost_coverage":0,"cost_sources":[],"event_count":1,"method":"sum","token_coverage":{"input_tokens":1}},"event_id":"018f0f7d-7a13-7cc2-8000-000000000010","event_type":"usage.recorded","input_tokens":1,"operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":"1"}
+{"agent_id":"agent-1","aggregation":{"cost_coverage":0,"cost_sources":[],"event_count":1,"method":"sum","token_coverage":{"input_tokens":1}},"event_id":"018f0f7d-7a13-7cc2-8000-000000000010","event_type":"usage.recorded","input_tokens":1,"operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":"1"}

conformance/fixtures/invalid/numeric-timestamp.json

@@ -1 +1 @@
-{"agent_id":"agent-1","event_id":"018f0f7d-7a13-7cc2-8000-000000000011","event_type":"usage.recorded","input_tokens":1,"operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":1787079700000000000}
+{"agent_id":"agent-1","event_id":"018f0f7d-7a13-7cc2-8000-000000000011","event_type":"usage.recorded","input_tokens":1,"operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":1787079700000000000}

conformance/fixtures/invalid/raw-content.json

@@ -1 +1 @@
-{"agent_id":"spiffe://example.test/agent/coder","event_id":"018f0f7d-7a13-7cc2-8000-000000000006","event_type":"usage.recorded","input_tokens":10,"operation":"chat","producer":{"name":"bad-adapter","version":"0.1.0"},"prompt":"copy the production credential","run_id":"run-unsafe","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":"1787079700000000000"}
+{"agent_id":"spiffe://example.test/agent/coder","event_id":"018f0f7d-7a13-7cc2-8000-000000000006","event_type":"usage.recorded","input_tokens":10,"operation":"chat","producer":{"name":"bad-adapter","version":"0.1.0"},"prompt":"copy the production credential","run_id":"run-unsafe","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079700000000000"}

conformance/fixtures/invalid/usage-without-measurement.json

@@ -1 +1 @@
-{"agent_id":"agent-1","event_id":"018f0f7d-7a13-7cc2-8000-000000000008","event_type":"usage.recorded","operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":"1"}
+{"agent_id":"agent-1","event_id":"018f0f7d-7a13-7cc2-8000-000000000008","event_type":"usage.recorded","operation":"chat","producer":{"name":"test","version":"1"},"run_id":"run-1","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":"1"}

conformance/fixtures/invalid/zero-trace-id.json

@@ -1 +1 @@
-{"action_type":"repository.read","agent_id":"agent-1","decision":"allow","enforcement_mode":"enforce","evaluation_duration_ns":1,"event_id":"018f0f7d-7a13-7cc2-8000-000000000007","event_type":"policy.decision","policy":{"engine":"opa","engine_version":"1.0"},"producer":{"name":"test","version":"1"},"resource_type":"repository","run_id":"run-1","spec_version":"0.1.0-dev","time_unix_nano":"1","trace_id":"00000000000000000000000000000000"}
+{"action_type":"repository.read","agent_id":"agent-1","decision":"allow","enforcement_mode":"enforce","evaluation_duration_ns":1,"event_id":"018f0f7d-7a13-7cc2-8000-000000000007","event_type":"policy.decision","policy":{"engine":"opa","engine_version":"1.0"},"producer":{"name":"test","version":"1"},"resource_type":"repository","run_id":"run-1","spec_version":"0.1.0-alpha.1","time_unix_nano":"1","trace_id":"00000000000000000000000000000000"}

conformance/fixtures/valid/action.json

@@ -1,5 +1,5 @@
 {
-  "spec_version": "0.1.0-dev",
+  "spec_version": "0.1.0-alpha.1",
   "event_id": "018f0f7d-7a13-7cc2-8000-000000000006",
   "event_type": "action.executed",
   "time_unix_nano": "1787079650000000000",

conformance/fixtures/valid/approval.json

@@ -1 +1 @@
-{"action_digest":{"algorithm":"sha256","value":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"},"actor_id":"reviewer-7d91","actor_type":"human","agent_id":"spiffe://example.test/agent/coder","approval_id":"approval-001","event_id":"018f0f7d-7a13-7cc2-8000-000000000002","event_type":"approval.approved","producer":{"name":"example-approval-adapter","version":"0.1.0"},"requested_at_unix_nano":"1787079500000000000","run_id":"run-governed-sdlc-001","span_id":"00f067aa0ba902b7","spec_version":"0.1.0-dev","time_unix_nano":"1787079580000000000","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736"}
+{"action_digest":{"algorithm":"sha256","value":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"},"actor_id":"reviewer-7d91","actor_type":"human","agent_id":"spiffe://example.test/agent/coder","approval_id":"approval-001","event_id":"018f0f7d-7a13-7cc2-8000-000000000002","event_type":"approval.approved","producer":{"name":"example-approval-adapter","version":"0.1.0"},"requested_at_unix_nano":"1787079500000000000","run_id":"run-governed-sdlc-001","span_id":"00f067aa0ba902b7","spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079580000000000","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736"}

conformance/fixtures/valid/data-flow.json

@@ -1 +1 @@
-{"agent_id":"spiffe://example.test/agent/architect","classification":{"producer":"example-dlp","taxonomy":"example.enterprise.v1","value":"confidential"},"content_digest":{"algorithm":"sha256","value":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"},"destination":{"id":"architecture-agent","kind":"agent"},"direction":"read","event_id":"018f0f7d-7a13-7cc2-8000-000000000004","event_type":"data_flow.observed","policy_decision":"allow","producer":{"name":"example-dataflow-adapter","version":"0.1.0"},"purpose":"generate_architecture","run_id":"run-governed-sdlc-001","size_bytes":18342,"source":{"id":"requirements-graph","kind":"knowledge_graph"},"spec_version":"0.1.0-dev","time_unix_nano":"1787079400000000000","transformation":"metadata_only"}
+{"agent_id":"spiffe://example.test/agent/architect","classification":{"producer":"example-dlp","taxonomy":"example.enterprise.v1","value":"confidential"},"content_digest":{"algorithm":"sha256","value":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"},"destination":{"id":"architecture-agent","kind":"agent"},"direction":"read","event_id":"018f0f7d-7a13-7cc2-8000-000000000004","event_type":"data_flow.observed","policy_decision":"allow","producer":{"name":"example-dataflow-adapter","version":"0.1.0"},"purpose":"generate_architecture","run_id":"run-governed-sdlc-001","size_bytes":18342,"source":{"id":"requirements-graph","kind":"knowledge_graph"},"spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079400000000000","transformation":"metadata_only"}

conformance/fixtures/valid/evidence.json

@@ -1 +1 @@
-{"capture_profile":"metadata_only","chain_digest":{"algorithm":"sha256","value":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"},"completeness":"complete","event_id":"018f0f7d-7a13-7cc2-8000-000000000005","event_type":"evidence.run_closed","producer":{"name":"agentrust-telemetry","version":"0.1.0-dev"},"run_id":"run-governed-sdlc-001","sequence":14,"spec_version":"0.1.0-dev","time_unix_nano":"1787079700000000000"}
+{"capture_profile":"metadata_only","chain_digest":{"algorithm":"sha256","value":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"},"completeness":"complete","event_id":"018f0f7d-7a13-7cc2-8000-000000000005","event_type":"evidence.run_closed","producer":{"name":"agentrust-telemetry","version":"0.1.0-alpha.1"},"run_id":"run-governed-sdlc-001","sequence":14,"spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079700000000000"}

conformance/fixtures/valid/policy-decision.json

@@ -1 +1 @@
-{"action_type":"repository.write","agent_id":"spiffe://example.test/agent/coder","decision":"deny","enforcement_mode":"enforce","evaluation_duration_ns":182000,"event_id":"018f0f7d-7a13-7cc2-8000-000000000001","event_type":"policy.decision","policy":{"bundle_digest":{"algorithm":"sha256","value":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"engine":"cedar","engine_version":"4.3.0","policy_id":"repo-write"},"producer":{"name":"example-policy-adapter","version":"0.1.0"},"reason_codes":["BRANCH_PROTECTED"],"resource_type":"git.repository","run_id":"run-governed-sdlc-001","span_id":"00f067aa0ba902b7","spec_version":"0.1.0-dev","time_unix_nano":"1787079600000000000","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736","workflow_id":"workflow-build-feature"}
+{"action_type":"repository.write","agent_id":"spiffe://example.test/agent/coder","decision":"deny","enforcement_mode":"enforce","evaluation_duration_ns":182000,"event_id":"018f0f7d-7a13-7cc2-8000-000000000001","event_type":"policy.decision","policy":{"bundle_digest":{"algorithm":"sha256","value":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"engine":"cedar","engine_version":"4.3.0","policy_id":"repo-write"},"producer":{"name":"example-policy-adapter","version":"0.1.0"},"reason_codes":["BRANCH_PROTECTED"],"resource_type":"git.repository","run_id":"run-governed-sdlc-001","span_id":"00f067aa0ba902b7","spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079600000000000","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736","workflow_id":"workflow-build-feature"}

conformance/fixtures/valid/usage.json

@@ -1 +1 @@
-{"agent_id":"spiffe://example.test/agent/coder","cost":{"amount":0.0124,"currency":"USD","pricing_version":"provider-2026-08-01","source":"provider"},"event_id":"018f0f7d-7a13-7cc2-8000-000000000003","event_type":"usage.recorded","input_tokens":4200,"operation":"chat","output_tokens":812,"producer":{"name":"example-usage-adapter","version":"0.1.0"},"provider":"example-ai","request_model":"example-model-2","run_id":"run-governed-sdlc-001","scope":"model_call","spec_version":"0.1.0-dev","time_unix_nano":"1787079590000000000","workflow_id":"workflow-build-feature"}
+{"agent_id":"spiffe://example.test/agent/coder","cost":{"amount":0.0124,"currency":"USD","pricing_version":"provider-2026-08-01","source":"provider"},"event_id":"018f0f7d-7a13-7cc2-8000-000000000003","event_type":"usage.recorded","input_tokens":4200,"operation":"chat","output_tokens":812,"producer":{"name":"example-usage-adapter","version":"0.1.0"},"provider":"example-ai","request_model":"example-model-2","run_id":"run-governed-sdlc-001","scope":"model_call","spec_version":"0.1.0-alpha.1","time_unix_nano":"1787079590000000000","workflow_id":"workflow-build-feature"}

docs/evidence-chain.md

@@ -1,6 +1,6 @@
 # Evidence chain profile
 
-Status: experimental `rfc8785-jcs-v1` for contract `0.1.0-dev`.
+Status: experimental `rfc8785-jcs-v1` for contract `0.1.0-alpha.1`.
 
 Each accepted event is validated and privacy-checked before entering the chain.
 Sequence numbers start at zero and represent acceptance order, not event time.

docs/otel-genai-compatibility.md

@@ -1,6 +1,6 @@
 # OpenTelemetry GenAI compatibility
 
-Status: pinned compatibility assessment for AgentTrust contract `0.1.0-dev`.
+Status: pinned compatibility assessment for AgentTrust contract `0.1.0-alpha.1`.
 
 The machine-readable matrix is [`compatibility/otel-genai.json`](../compatibility/otel-genai.json).
 It is pinned to OpenTelemetry's dedicated GenAI semantic-conventions repository

docs/otel-projection.md

@@ -1,6 +1,6 @@
 # OpenTelemetry projection profile
 
-Status: experimental for contract `0.1.0-dev`.
+Status: experimental for contract `0.1.0-alpha.1`.
 
 The normalized JSON event is the source contract. OpenTelemetry is a projection, not an alternative event model.
 

examples/manual_governance.py

@@ -14,7 +14,7 @@ def emit(self, record):
 
 
 event = {
-    "spec_version": "0.1.0-dev",
+    "spec_version": "0.1.0-alpha.1",
     "event_id": str(uuid.uuid4()),
     "event_type": "policy.decision",
     "time_unix_nano": str(time.time_ns()),

packages/typescript/schemas/envelope.schema.json

@@ -4,7 +4,7 @@
   "type": "object",
   "required": ["spec_version", "event_id", "event_type", "time_unix_nano", "run_id", "producer"],
   "properties": {
-    "spec_version": {"const": "0.1.0-dev"},
+    "spec_version": {"const": "0.1.0-alpha.1"},
     "event_id": {"$ref": "common.schema.json#/$defs/event_id"},
     "event_type": {"type": "string", "pattern": "^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$", "maxLength": 128},
     "time_unix_nano": {"$ref": "common.schema.json#/$defs/time_unix_nano"},

packages/typescript/src/factory.ts

@@ -26,7 +26,7 @@ export class EventFactory {
     if (collisions.length) throw new Error(`payload cannot override envelope fields: ${collisions.join(", ")}`);
     const normalizedPayload = Object.fromEntries(Object.entries(payload).map(([key, value]) => [key, key.endsWith("_at_unix_nano") ? unixNano(value) : value]));
     const event = {
-      spec_version: "0.1.0-dev" as const,
+      spec_version: "0.1.0-alpha.1" as const,
       event_id: fields.eventId ?? this.eventIdFactory(), event_type: eventType,
       time_unix_nano: unixNano(fields.timeUnixNano ?? this.clockNs()),
       run_id: fields.runId, producer: structuredClone(this.#producer), ...normalizedPayload,

packages/typescript/src/types.ts

@@ -1,6 +1,6 @@
 export type Scalar = string | number | boolean;
 export type NormalizedEvent = Record<string, unknown> & {
-  spec_version: "0.1.0-dev";
+  spec_version: "0.1.0-alpha.1";
   event_id: string;
   event_type: string;
   time_unix_nano: string;

packages/typescript/test/trace-finalizer.test.ts

@@ -21,7 +21,7 @@ test("finalizer derives claims then signs, validates, and self-verifies", () =>
 });
 test("tool transcript uses the shared RFC 8785 sequence/event digest", () => {
   const record = finalizeTrace(snapshot([fixture("action.json")]), config, {signingKey: "private", codec: new RecordingCodec()});
-  assert.deepEqual(record.tool_transcript, {hash: "sha256:c697a0cb7991d61a4b4a7454de3be3a24046cbffb62f5fc14784ce52ccafe497", call_count: 1});
+  assert.deepEqual(record.tool_transcript, {hash: "sha256:3ef76a71752a93a3544873e0199b3aa5c2297f857b605e8335bf43728169128c", call_count: 1});
   const changed = fixture("action.json"); changed.outcome = "error"; changed.error_type = "remote_error";
   assert.notEqual((finalizeTrace(snapshot([changed]), config, {signingKey: "private", codec: new RecordingCodec()}).tool_transcript as Record<string, unknown>).hash, (record.tool_transcript as Record<string, unknown>).hash);
 });

spec/schema/envelope.schema.json

@@ -4,7 +4,7 @@
   "type": "object",
   "required": ["spec_version", "event_id", "event_type", "time_unix_nano", "run_id", "producer"],
   "properties": {
-    "spec_version": {"const": "0.1.0-dev"},
+    "spec_version": {"const": "0.1.0-alpha.1"},
     "event_id": {"$ref": "common.schema.json#/$defs/event_id"},
     "event_type": {"type": "string", "pattern": "^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$", "maxLength": 128},
     "time_unix_nano": {"$ref": "common.schema.json#/$defs/time_unix_nano"},

src/agentrust_telemetry/adapters/base.py

@@ -55,7 +55,7 @@ def build(
             raise ValueError(f"payload cannot override envelope fields: {collision}")
         timestamp = self._clock_ns() if time_unix_nano is None else time_unix_nano
         event: dict[str, Any] = {
-            "spec_version": "0.1.0-dev",
+            "spec_version": "0.1.0-alpha.1",
             "event_id": event_id or str(self._event_id_factory()),
             "event_type": event_type,
             "time_unix_nano": _unix_nano(timestamp),

src/agentrust_telemetry/schemas/envelope.schema.json

@@ -4,7 +4,7 @@
   "type": "object",
   "required": ["spec_version", "event_id", "event_type", "time_unix_nano", "run_id", "producer"],
   "properties": {
-    "spec_version": {"const": "0.1.0-dev"},
+    "spec_version": {"const": "0.1.0-alpha.1"},
     "event_id": {"$ref": "common.schema.json#/$defs/event_id"},
     "event_type": {"type": "string", "pattern": "^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$", "maxLength": 128},
     "time_unix_nano": {"$ref": "common.schema.json#/$defs/time_unix_nano"},

tests/test_repository_gates.py

@@ -55,7 +55,7 @@ def test_declared_versions_are_consistent(self):
 
     def test_contract_versions_map_to_ecosystem_spellings(self):
         cases = {
-            "0.1.0-dev": ("0.1.0.dev0", "0.1.0-dev.0"),
+            "0.1.0-alpha.1": ("0.1.0.dev0", "0.1.0-alpha.1.0"),
             "0.1.0-alpha.1": ("0.1.0a1", "0.1.0-alpha.1"),
             "0.1.0-beta.2": ("0.1.0b2", "0.1.0-beta.2"),
             "0.1.0-rc.3": ("0.1.0rc3", "0.1.0-rc.3"),

tests/test_trace_adapter.py

@@ -74,7 +74,7 @@ def test_action_events_create_truthful_tool_transcript(self):
         self.assertRegex(record["tool_transcript"]["hash"], r"^sha256:[0-9a-f]{64}$")
         self.assertEqual(
             record["tool_transcript"]["hash"],
-            "sha256:c697a0cb7991d61a4b4a7454de3be3a24046cbffb62f5fc14784ce52ccafe497",
+            "sha256:3ef76a71752a93a3544873e0199b3aa5c2297f857b605e8335bf43728169128c",
         )
 
         changed = fixture("action.json")