chore(deps): update agent-manifest requirement from >=0.2.0 to >=0.3.0

[dependabot]

Updates the requirements on agent-manifest to permit the latest version.

Release notes

Sourced from agent-manifest's releases.

python-v0.3.0

What's Changed

• fix: remove partner names and commercial-program language by @​imran-siddique in agentrust-io/agent-manifest#187
• feat(cli): allow CLI verify to accept a trusted public key by @​imran-siddique in agentrust-io/agent-manifest#188
• chore(deps): bump actions/checkout from 4 to 7 by @​dependabot[bot] in agentrust-io/agent-manifest#189
• fix(docs): correct tutorial hallucinations by @​imran-siddique in agentrust-io/agent-manifest#191
• fix(docs): correct tutorial hallucinations by @​imran-siddique in agentrust-io/agent-manifest#192
• feat: v0.2 memory checkpoint/delta binding protocol (§3.2.6.2) by @​imran-siddique in agentrust-io/agent-manifest#193
• feat(attestation): runtime freshness proofs via attest_runtime_state() by @​imran-siddique in agentrust-io/agent-manifest#194
• feat(governance): agt verify CI step and release evidence — closes #195 by @​imran-siddique in agentrust-io/agent-manifest#198
• feat(verify): A2A delegation chain verification via structural validation and require_delegation by @​imran-siddique in agentrust-io/agent-manifest#197
• docs: standardize OPAQUE brand capitalization by @​imran-siddique in agentrust-io/agent-manifest#200
• fix(attestation): correct SNP REPORT_DATA vs HOST_DATA in spec/docs; mark providers experimental by @​imran-siddique in agentrust-io/agent-manifest#207
• docs: scope threat-model claims to what TEE attestation actually provides by @​imran-siddique in agentrust-io/agent-manifest#208
• fix(hw): read SNP REPORT_DATA at 0x50; correct TDX RTMR/Quote claims by @​imran-siddique in agentrust-io/agent-manifest#209
• feat(verify): attestation-chain verifier scaffold (#204 phase 1) by @​imran-siddique in agentrust-io/agent-manifest#210
• fix(verify): bind delegation root to issuer, enforce scope-narrowing, schema-validate, honest CLI by @​imran-siddique in agentrust-io/agent-manifest#211
• fix(delegation): reconcile principal-type set with PrincipalType enum by @​imran-siddique in agentrust-io/agent-manifest#212
• chore(release): agent-manifest 0.2.0 by @​imran-siddique in agentrust-io/agent-manifest#213
• fix(ci): resolve agt CLI in release governance step by @​imran-siddique in agentrust-io/agent-manifest#214
• feat(docs): SEO and AEO optimization by @​imran-siddique in agentrust-io/agent-manifest#217
• feat(sdk): expose the delegation verifier in the public API by @​imran-siddique in agentrust-io/agent-manifest#218
• chore: add MIT LICENSE and pin PyPI publish action to SHA by @​imran-siddique in agentrust-io/agent-manifest#219
• fix(verify): bind trusted keys to manifest issuers by @​carloshvp in agentrust-io/agent-manifest#220
• chore(release): agent-manifest python v0.3.0 by @​imran-siddique in agentrust-io/agent-manifest#222

Full Changelog: agentrust-io/agent-manifest@python-v0.1.1...python-v0.3.0

Changelog

Sourced from agent-manifest's changelog.

[0.3.0] — 2026-07-15

Security

[SDK] Verification can now bind trusted signing keys to authorized issuers. VerificationContext.trusted_key_issuers maps each trusted key_id to the issuer SPIFFE URIs allowed to sign with it; when supplied, a manifest whose signing key is not authorized for its declared issuer is rejected (fail-closed). Opt-in and backward compatible: an empty map preserves prior behavior.

Added

[SDK] Delegation verification is now part of the public API: verify_delegation_chain, verify_hitl_approval, delegation_depth_exceeded, DelegationHopSigner, and HitlApprovalSigner are exported from agent_manifest. Downstream projects (for example agentrust-io/cA2A) call verify_delegation_chain to verify an inbound peer's delegation chain, so the two implementations stay aligned rather than duplicated. No behavior change; these were previously reachable only through the private _delegation module.

[0.2.0] — 2026-06-30

Security

[SDK] Delegation chain root is now bound to the manifest issuer/agent identity — forged-authority chains are rejected. [SDK] Scope-narrowing enforces constraint-superset, non-increasing ttl_seconds, and non-increasing max_delegation_depth. [SDK] Verification schema-validates the manifest (fail-closed); CLI verify no longer prints bare VALID when artifact bindings were not checked.

Changed

[SPEC] SNP/TDX attestation field corrections and provider experimental markers (REPORT_DATA at 0x50); threat-model/levels documentation scoped to what TEE attestation provides.

Fixed

[SDK] PrincipalType set reconciled (no service).

Added

[SPEC] Memory Checkpoint & Delta Protocol (Section 3.2.6.2) — v0.2 incremental memory binding.

• Append-only operation-log (merkle-log) model lets persistent memory evolve across a session and prove the evolution was governed, without re-approving the whole store.
• Per-representation leaf canonicalization: key-value, semantic/vector (binds embedding + model id), and graph-RAG (nodes + edges).
• A governed checkpoint advance is accepted only with a valid RFC 9162 §2.1.2 consistency proof; an unproven change still triggers v0.1 drift detection (MEMORY_DRIFT_DETECTED) — fail-closed preserved.

[SDK] MerkleTree.consistency_proof + verify_consistency (RFC 9162 §2.1.2) in agent_manifest._merkle. [SDK] agent_manifest._memory_delta: build_memory_tree, MemoryCheckpoint, verify_delta, fold_kv. [SDK] MemoryCheckpointBinding model (memory_root anchor; additive — MemoryBaselineBinding and snapshot_hash semantics unchanged).

[SDK] Export the verification API from the package root, so relying parties and gateways call agent_manifest.verify_manifest() and VerificationContext directly instead of importing the private _verify module (#176).

[SPEC] Document runtime-session binding guidance for gateways, including the signed fields that bind agent_id, artifact hashes, validity windows, delegation handling, and attestation separation (#177).

[0.1.0] — 2026-06-23

Stable launch release at Confidential Computing Summit, June 23 2026.

Fixed

... (truncated)

Commits

• e95ef8e chore(release): agent-manifest python v0.3.0 (#222)
• 192473f Bind trusted keys to manifest issuers (#220)
• 78fb58b ci: pin gh-action-pypi-publish to commit SHA (v1.14.0) (#219)
• 0bd4344 feat(sdk): expose the delegation verifier in the public API (#218)
• 67c21db feat(docs): SEO and AEO optimization (#217)
• 63d5f84 fix(ci): install agent-governance-toolkit so agt CLI resolves in release gove...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)