chore(release): 0.3.1

.github/dependabot.yml

@@ -30,3 +30,10 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    # Digest refreshes and 3.11 patch releases only. Moving the image to a new
+    # Python minor is a deliberate change with its own PR and test run.
+    ignore:
+      - dependency-name: "python"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-09-26
+
 ### Fixed
 
 - Malformed input from outside now fails with the documented error instead of
@@ -16,13 +18,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   (a non-ASCII one raised `TypeError`); `DelegationCredential.from_dict` and
   `verify_trace_dag` refuse entries that are not objects; the reference server
   answers 400 to bodies that hit the JSON parser's nesting or integer-digit
-  limits instead of dropping the connection.
+  limits instead of dropping the connection (#202).
 - `canonicalize` refuses non-string object keys. It coerced them with `str()`, so
-  `{1: "a", "1": "b"}` serialized one key twice.
+  `{1: "a", "1": "b"}` serialized one key twice (#202).
 - The container image installs its dependencies from hash-pinned locks
   (`requirements/runtime.txt`, `requirements/build.txt`) and pins the base image
   by digest. ClusterFuzzLite targets cover the wire documents, the attestation
-  parsers and the canonicalizer.
+  parsers and the canonicalizer (#202).
 
 ## [0.3.0] - 2026-09-25
 
@@ -408,7 +410,8 @@ built/stubbed boundary.
 - The sealed channel does not by itself establish the enclave-held-private-key property; that is a hardware attestation guarantee that lands with real-hardware validation.
 - Alpha schemas: the delegation credential and TRACE link schemas are not yet stable or versioned, and peer attestation evidence is not yet RATS/EAT conformant.
 
-[Unreleased]: https://github.com/agentrust-io/ca2a/compare/v0.3.0...main
+[Unreleased]: https://github.com/agentrust-io/ca2a/compare/v0.3.1...main
+[0.3.1]: https://github.com/agentrust-io/ca2a/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/agentrust-io/ca2a/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/agentrust-io/ca2a/compare/v0.1.0a1...v0.2.0
 [0.1.0a1]: https://github.com/agentrust-io/ca2a/releases/tag/v0.1.0a1

index.md

@@ -16,7 +16,7 @@ cA2A is a profile on A2A that adds signed attenuated delegation, peer appraisal,
 [What this proves, and what it does not](LIMITATIONS.md){ .md-button }
 
 !!! tip "TL;DR"
-    [ca2a-runtime](https://pypi.org/project/ca2a-runtime/) 0.3.0 (MIT developer preview; the PyPI name `ca2a` belongs to an unrelated project) rejects scope escalation offline with no hardware or running peer. SEV-SNP and TDX appraisal ran on real Azure and GCP evidence, including an Azure SEV-SNP peer calling a GCP TDX peer on 2026-07-27, but peer appraisal is one-directional so far and binding the seal to a verified measurement on a live call is on the roadmap.
+    [ca2a-runtime](https://pypi.org/project/ca2a-runtime/) 0.3.1 (MIT developer preview; the PyPI name `ca2a` belongs to an unrelated project) rejects scope escalation offline with no hardware or running peer. SEV-SNP and TDX appraisal ran on real Azure and GCP evidence, including an Azure SEV-SNP peer calling a GCP TDX peer on 2026-07-27, but peer appraisal is one-directional so far and binding the seal to a verified measurement on a live call is on the roadmap.
 
 <div class="grid cards" markdown>
 
@@ -71,4 +71,4 @@ Software and hardware modes provide different assurance. Peer appraisal has been
 
 For the architecture and trust boundaries, read [How It Works](docs/concepts.md). The normative profile, with the delegation chain, sealed channel, and conformance rules, is in [Profile](docs/spec/profile.md).
 
-**Status:** ca2a-runtime 0.3.0 developer preview · MIT · hosting at the Agentic AI Foundation proposed, not accepted · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.
+**Status:** ca2a-runtime 0.3.1 developer preview · MIT · hosting at the Agentic AI Foundation proposed, not accepted · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ca2a-runtime"
-version = "0.3.0"
+version = "0.3.1"
 description = "Confidential agent-to-agent runtime: attested, attenuated delegation and sealed peer channels for A2A"
 readme = "README.md"
 license = { text = "MIT" }

tests/unit/test_release_artifacts.py

@@ -21,7 +21,7 @@ def test_runtime_version_comes_from_installed_package_metadata() -> None:
 
 def test_public_release_metadata_is_stable() -> None:
     project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]
-    assert project["version"] == "0.3.0"
+    assert project["version"] == "0.3.1"
     assert "Development Status :: 4 - Beta" in project["classifiers"]
     assert not any("Alpha" in classifier for classifier in project["classifiers"])