chore(deps): update ca2a-runtime requirement from >=0.1.0a1 to >=0.2.0

[dependabot]

Updates the requirements on ca2a-runtime to permit the latest version.

Release notes

Sourced from ca2a-runtime's releases.

cA2A 0.2.0 — Developer Preview

cA2A 0.2.0 is the first normal release of the Confidential Agent-to-Agent profile and runtime. It is ready for evaluation through a standard install:

pip install ca2a-runtime

What ships

• A normative A2A extension profile for attenuated, holder-bound delegation.
• A live peer runtime that verifies delegation, intersects it with local Cedar policy, enforces the decision, and emits signed TRACE provenance.
• An attestation-gated sealed channel using X25519, HKDF-SHA256, and ChaCha20-Poly1305.
• Fail-closed SEV-SNP, Intel TDX, and TPM 2.0 appraisal, including validation against genuine Azure and GCP evidence.
• Mutual-attestation protocol support, an official a2a-sdk bridge, offline DAG verification, and a runnable MUST-level conformance suite.
• Startup-bound Agent Manifest identity. The runtime accepts v0.1 JSON and v0.2 COSE manifests and refuses startup when configured node identity does not match the signed manifest.
• A rootless runtime container published as ghcr.io/agentrust-io/ca2a-runtime:v0.2.0 and latest, with keyless signing and build provenance.

Security hardening

• Delegation roots must be explicitly trusted; self-consistent attacker-minted roots are rejected.
• Holder proofs commit to every security-relevant request field, including the provenance parent link.
• Credential parsing rejects coercion, unknown fields, malformed encodings, invalid scopes, and ambiguous numeric representations.
• The reference HTTP boundary now bounds request bodies, timeouts, nonce length, UTF-8 decoding, and error responses.
• Release artifacts are built once, metadata-checked, installed and smoke-tested as both wheel and source distribution, then published through PyPI trusted publishing only when the release tag matches the package version.

Verification evidence

• 495 tests passed and 2 hardware-dependent tests skipped in the full local unit and conformance run.
• Python 3.11, 3.12, and 3.13 passed on Linux and Windows after merge.
• Ruff, formatting, mypy, Bandit, CodeQL, container build, benchmark, and strict governance verification passed.

Maturity and boundaries

... (truncated)

Changelog

Sourced from ca2a-runtime's changelog.

[0.2.0] - 2026-08-18

This is the first normal cA2A release. It promotes the project from its initial preview package to a runnable Developer Preview with runtime enforcement, sealed peer channels, signed TRACE provenance, real-evidence hardware appraisal, a conformance suite, and startup-bound Agent Manifest identity.

Fixed

• collect_report confirms the configfs-TSM provider before reading outblob (#86 follow-up). Reading outblob is what makes the platform generate and sign a report, so checking the provider afterwards meant a mismatched guest signed a report over the caller's binding and the result was then discarded. Nothing was returned and the entry was removed either way, so this was not a disclosure, but it asked the hardware to sign something no one could use. The provider check now gates the read. A test asserts outblob is never read on a mismatch, so the ordering cannot quietly regress.

• The holder proof now commits to parent_record_hash (#106). It committed every other request field that reaches the emitted provenance record, and missed this one, so a party on the path could alter where the hop linked in the DAG while the proof still verified. The result was a record attached to the wrong parent: a misattributed hop rather than forged authority or widened scope, which is why it was rated low, but it was inconsistent on its own terms. The proof already commits to record_id, so committing a record's own identifier while leaving its parent link open was half a commitment. Committed either way, so a root hop cannot have a parent bolted onto it. The rule is now stated in P-4a and guarded by a test: every field of the request that reaches the record is committed.

• Removed ProofReplayCache, keeping the holder-proof path stateless (#104). It made a proof single-use by remembering it, but bought that with per-node state in a design that is deliberately stateless, and its expiry pass walked every entry on each call, so it degraded quadratically as it filled. Holder binding is now at-most-once-per-window, bounded by the challenge TTL, which is the same guarantee ca2a_runtime.challenge documents for itself. A deployment that needs exactly-once supplies state at the challenge rather than at the proof, so the codebase carries one such decision instead of two. PeerNode no longer takes seen_proofs, and verify_holder_proof no longer takes seen.

Security

• Runtime authorization now requires the delegation chain's root issuer to be present in the callee's trusted_root_issuers. Previously, any party could mint a self-consistent root chain granting itself a locally allowed capability; every signature and attenuation check passed because no local trust anchor was consulted. ca2a start now refuses to launch without at least one pinned root.

• Delegation credential parsing now rejects type coercion, unknown fields, malformed key/signature encodings, duplicate or invalid scopes, and non-integer depths. Previously a different JSON representation (for example 0.9) could normalize to the signed model (0) and verify, creating cross-implementation ambiguity about what the issuer signed.

• Hardened the unauthenticated reference HTTP boundary. Malformed Content-Length values and invalid UTF-8 now receive bounded 400 responses instead of escaping the handler, incomplete bodies time out, and handshake requests must carry exactly one nonce no longer than 256 characters. Provider failures during the handshake also use the structured cA2A error path.

• PyPI publication now runs only from a published GitHub Release whose tag exactly matches the project version. The workflow validates metadata, installs and smoke-tests both the wheel and source distribution in clean environments, and publishes only after those gates pass. Runtime __version__ now comes from installed package metadata instead of a stale independent constant.

• Added the missing release container as a multi-stage, rootless image. Runtime installation is offline from the builder wheelhouse and the build context excludes VCS, tests, docs, and local environments. Pull requests now build the image without registry/signing privileges, while tagged releases retain version and latest tags, keyless signing, and provenance attestation. All third-party container actions are pinned to immutable commits.

• Raised dependency floors past newly disclosed vulnerable releases: cryptography>=50.0 (PYSEC-2026-3552/3553/3554), aiohttp>=3.14.3

... (truncated)

Commits

• 61564f6 release: cA2A 0.2.0 with Agent Manifest identity binding (#121)
• 8c49177 fix: enforce all repository maintainers (#118)
• 0bc7e8c docs(roadmap): add upstream A2A interoperability workstream (#113)
• 454721a fix(tee): check the TSM provider before reading outblob (#112)
• acdbcf4 feat(delegation): add credential validity windows (not_before/not_after) (#110)
• 5dd77b2 Own hardware validation fixtures in-repo (#111)
• 26c8311 fix(delegation): commit the parent link, and drop the proof replay cache (#107)
• 522771e fix: raise security dependency floors (#103)
• b038666 fix: add hardened runtime container (#102)
• f735849 ci: verify Python release artifacts (#101)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)