release: 0.1.0-alpha.2

[imran-siddique]

Release preparation for 0.1.0-alpha.2, following step 1 and 2 of RELEASING.md.

What is in this release

All three already merged to main:

PR
#41	wire spec_version now matches spec/VERSION
#42	schema $id moved off agentrust.io, a domain we do not own
#43	npm dist-tag derived from spec/VERSION

Why a new version instead of releasing v0.1.0-alpha.1

npm already holds 0.1.0-alpha.1 from the bootstrap publish that RELEASING.md explicitly sanctions:

If npm does not expose publisher settings until the first version exists, bootstrap only that first package ownership using npm's interactive 2FA flow

release.yml publishes both registries from one release event, and release-assets has needs: [publish-pypi, publish-npm]. Cutting v0.1.0-alpha.1 would publish PyPI, fail publish-npm on the duplicate version, and skip attestation entirely. A fresh version lets one build feed both registries with provenance intact, which is what the pipeline exists to do.

PyPI has never been published, so 0.1.0-alpha.2 will be its first version.

On the moved digests

spec/VERSION is the contract version and the source both package versions derive from, so bumping it changes the wire spec_version, which sits inside the RFC 8785 bytes that get hashed. Both goldens were regenerated from the code rather than hand-edited, and Python and TypeScript independently agree on the new tool-transcript hash.

A dead test case, found while bumping

tests/test_repository_gates.py had "0.1.0-alpha.1" as a dict key twice:

"0.1.0-alpha.1": ("0.1.0.dev0", "0.1.0-alpha.1.0"),
"0.1.0-alpha.1": ("0.1.0a1", "0.1.0-alpha.1"),

Python keeps the last, so the first entry was silently discarded and the dev phase has never been tested. Its npm spelling was wrong as well: 0.1.0-alpha.1.0 is not something ecosystem_versions can produce for any input. Restored as a real 0.1.0-dev case, with both alpha spellings now asserted.

Verification

Gate	Result
check_versions	contract=0.1.0-alpha.2 python=0.1.0a2 npm=0.1.0-alpha.2
check_release_tag v0.1.0-alpha.2	pass
npm_dist_tag	alpha
check_schemas / check_typescript_schemas / check_otel_compatibility	pass
Conformance fixtures	13/13
Python tests	111 pass
TypeScript tests	41 pass

After this merges

1. Configure the npm trusted publisher for @agentrust-io/telemetry, now possible because the package exists.
2. Create the GitHub release tagged v0.1.0-alpha.2 targeting main.
3. Approve the pypi and npm deployment jobs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xyu1wLe68MPCKaqUXeEpXn