From 992fc3321f0e69ee337d79b893ad52badf414784 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 05:13:22 +0000 Subject: [PATCH 1/2] build(deps-dev): bump agentrust-trace-tests Bumps [agentrust-trace-tests](https://github.com/agentrust-io/trace-tests) from 0.5.0 to 0.5.1. - [Release notes](https://github.com/agentrust-io/trace-tests/releases) - [Changelog](https://github.com/agentrust-io/trace-tests/blob/main/CHANGELOG.md) - [Commits](https://github.com/agentrust-io/trace-tests/compare/v0.5.0...v0.5.1) --- updated-dependencies: - dependency-name: agentrust-trace-tests dependency-version: 0.5.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- integrations/ramen-ai-cmcp/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integrations/ramen-ai-cmcp/pyproject.toml b/integrations/ramen-ai-cmcp/pyproject.toml index e590188..275a2b4 100644 --- a/integrations/ramen-ai-cmcp/pyproject.toml +++ b/integrations/ramen-ai-cmcp/pyproject.toml @@ -15,7 +15,7 @@ dependencies = [ [project.optional-dependencies] test = [ - "agentrust-trace-tests==0.5.0", + "agentrust-trace-tests==0.5.1", "pytest==9.1.1", ] From 50ad2c000775d5ba012fed15b34b2438263dd9fc Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Tue, 1 Sep 2026 12:22:40 -0700 Subject: [PATCH 2/2] test(ramen-ai-cmcp): expect TR-RTE-004 at Level 1 agentrust-trace-tests 0.5.1 adds TR-RTE-004, which fires at Level 1 when no verifier nonce is supplied. This harness does not issue one and the fixture carries no runtime.nonce, so a software-only record now fails Level 1 on two runtime rules rather than one. The assertion stays an exact comparison deliberately: a future change to the Level 1 finding set should fail this test rather than pass silently. Coupled to the version bump in the same PR. TR-RTE-004 does not exist in 0.5.0, so this test fails against the previous pin and the bump fails against the previous test. Neither can land alone. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_012yyHFd4YA35oNUjhrztJSb --- .../ramen-ai-cmcp/tests/test_mapping.py | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/integrations/ramen-ai-cmcp/tests/test_mapping.py b/integrations/ramen-ai-cmcp/tests/test_mapping.py index eddf537..b7a5ff8 100644 --- a/integrations/ramen-ai-cmcp/tests/test_mapping.py +++ b/integrations/ramen-ai-cmcp/tests/test_mapping.py @@ -253,7 +253,16 @@ def test_signed_software_record_passes_level_0(self, trace_key): finding.status for finding in findings if finding.code == "TR-SIG-005" ] == [Status.PASS] - def test_signed_software_record_fails_only_level_1_runtime_rule(self, trace_key): + def test_signed_software_record_fails_level_1_runtime_rules(self, trace_key): + """A software-only record fails Level 1 on runtime rules only. + + Two of them as of agentrust-trace-tests 0.5.1. TR-RTE-001 is the platform + rule and has always fired here. TR-RTE-004 was added in 0.5.1 and fires + because no verifier nonce is supplied: this harness does not issue one, and + the record carries no ``runtime.nonce`` to match it if it did. The assertion + stays an exact comparison on purpose, so that a future change to the Level 1 + finding set fails this test rather than passing silently. + """ record = _build(_load("vector1_allowed.json"), iat=int(time.time())) results = run_trace_tests(record, "trace", level=1) failures = [ @@ -268,5 +277,10 @@ def test_signed_software_record_fails_only_level_1_runtime_rule(self, trace_key) "TR-RTE-001: runtime.platform 'software-only' is development-mode " "and not acceptable for hardware-attested levels (Level 1 requires " "a hardware TEE platform)", - ) + ), + ( + "TR-RTE-004", + "TR-RTE-004: Level 1+ verification requires the verifier's " + "expected nonce", + ), ]