build(deps-dev): bump agentrust-trace-tests from 0.5.0 to 0.5.1 in /integrations/ramen-ai-cmcp

[dependabot]

Bumps agentrust-trace-tests from 0.5.0 to 0.5.1.

Release notes

Sourced from agentrust-trace-tests's releases.

agentrust-trace-tests 0.5.1

What's Changed

• measurement: does the suite notice when a conformance check breaks by @​imran-siddique in agentrust-io/trace-tests#57
• chore(deps): bump github/codeql-action from 4.37.4 to 4.37.6 by @​dependabot[bot] in agentrust-io/trace-tests#58
• docs: align documented slsa_level range with schema and tests by @​opento-suggestions in agentrust-io/trace-tests#61
• measurement: refuse to report when the suite imports a different tree by @​lywinged in agentrust-io/trace-tests#59
• Add OpenShell imported-evidence conformance by @​imran-siddique in agentrust-io/trace-tests#64
• test: guard the hand-written enum copies against the packaged schema by @​lywinged in agentrust-io/trace-tests#62
• fix(measurement): purge pycache, so a run measures the tree it just rewrote by @​lywinged in agentrust-io/trace-tests#60
• chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in agentrust-io/trace-tests#65
• fix: enforce all repository maintainers by @​imran-siddique in agentrust-io/trace-tests#67
• fix(schema): resync the packaged copy, and a vector that uses the field whose absence hid it by @​lywinged in agentrust-io/trace-tests#68
• fix(tr-sig): canonicalize with RFC 8785, which is the rule this suite… by @​lywinged in agentrust-io/trace-tests#66
• docs: give the site its own landing page instead of rendering the README by @​imran-siddique in agentrust-io/trace-tests#71
• fix(seo): social cards said "Home", not the page title by @​imran-siddique in agentrust-io/trace-tests#72
• ci: deploy the docs when the theme or the landing page changes by @​imran-siddique in agentrust-io/trace-tests#73
• docs: document project sponsorship roles by @​imran-siddique in agentrust-io/trace-tests#77
• docs: align the published error codes and record samples with the modules by @​lywinged in agentrust-io/trace-tests#74
• fix(tr-sig): report a malformed record instead of raising on it by @​lywinged in agentrust-io/trace-tests#75
• fix(tr-sig): stop publishing a finding whose message names a different code by @​lywinged in agentrust-io/trace-tests#76
• ci: fail closed when CodeQL analysis fails by @​imran-siddique in agentrust-io/trace-tests#78

New Contributors

• @​opento-suggestions made their first contribution in agentrust-io/trace-tests#61
• @​lywinged made their first contribution in agentrust-io/trace-tests#59

Full Changelog: agentrust-io/trace-tests@v0.5.0...v0.5.1

Changelog

Sourced from agentrust-trace-tests's changelog.

v0.5.1 — 2026-08-22

• Level 1 and Level 2 verification now requires a verifier-issued challenge via --expected-nonce and checks it against the signed runtime.nonce using constant-time comparison. Previously nonce binding existed only as an assertion over the repository's own pytest fixture; the shipped runner and CLI could report conformance for a fresh signed record containing an attacker-chosen or replayed nonce.

Commits

• 3af2b53 ci: fail closed when CodeQL analysis fails (#78)
• d9c0da1 fix(tr-sig): stop publishing a finding whose message names a different code (...
• f7669e6 fix(tr-sig): report a malformed record instead of raising on it (#75)
• 71e6bf2 docs: align the published error codes and record samples with the modules (#74)
• 10911bd docs: document project sponsorship roles (#77)
• 121c18b ci: deploy the docs when the theme or the landing page changes (#73)
• af4f010 fix(seo): social cards said "Home", not the page title (#72)
• c89a983 docs: give the site its own landing page instead of rendering the README (#71)
• c725bbb fix(tr-sig): canonicalize with RFC 8785, which is the rule this suite scores ...
• 84ecb81 fix(schema): resync the packaged copy, and a vector that uses the field whose...
• Additional commits viewable in compare view

[imran-siddique]

Pushed the coupled test fix onto this branch rather than opening a separate PR, because the two changes cannot land apart.

What was failing. ramen-ai-cmcp/tests/test_mapping.py::test_signed_software_record_fails_only_level_1_runtime_rule asserts the Level 1 failure set by exact equality against a single finding. Suite 0.5.1 adds TR-RTE-004, which fires when no verifier nonce is supplied, so a software-only record now fails Level 1 on two runtime rules rather than one. The test name said so: "fails only level 1 runtime rule".

Why it could not be a separate PR. I checked which codes each version emits:

0.5.0 tr_rte: TR-RTE-001, TR-RTE-002, TR-RTE-003
0.5.1 tr_rte: TR-RTE-001, TR-RTE-002, TR-RTE-003, TR-RTE-004

So the updated test fails against the 0.5.0 pin currently on main, and the bump fails against the current test. Landing either alone leaves main red. They are strictly coupled and belong in one commit.

Verified locally, running the way ramen-ai-cmcp-conformance.yml does:

• fixed test against 0.5.1: passes; full ramen-ai-cmcp/tests suite 23 passed
• fixed test against 0.5.0: fails, which is the coupling above, demonstrated rather than asserted

I kept the assertion as an exact comparison on purpose. A conformance integration test should break when the suite's finding set changes; that is how we find out. The defect here was that nobody updated it, not that it was strict.

Note that TR-RTE-004 carries two different messages depending on the caller: "Level 1+ verification requires the verifier's expected nonce" when the operator supplies no --expected-nonce, and "runtime.nonce is missing or empty" when they do but the record has none. This harness hits the first. Worth knowing, because the first reads like a record defect and is not one.

Merging once CI is green. If dependabot force-pushes this branch the test fix goes with it, in which case I will reapply it.

[imran-siddique]

Merging. Three things had to be true together and now are.

The bump itself was never the problem. agentrust-trace-tests 0.5.1 adds TR-RTE-004, which fires at Level 1 when no verifier nonce is supplied, so a software-only record now fails Level 1 on two runtime rules instead of one. The ramen-ai-cmcp conformance test pinned the old finding set by exact equality, and its own name recorded the assumption: "fails only level 1 runtime rule".

The coupling is why the fix rode on this branch. TR-RTE-004 does not exist in 0.5.0, which I confirmed by reading both versions' tr_rte module. So the updated test fails against the pin on main, and the bump fails against the test on main. Either alone leaves the repository red. One commit, both changes.

The validate failure was mine and unrelated to this PR. It came from #148, which I merged while only its hold gate was reporting: an epi-recorder key that tested_against does not permit, and a stale generated README index. Both fixed in #158, and this branch has main merged in, since a stale-base validate does not clear on a re-run.

Fifteen checks, only the maintainer gate red, including all four conformance matrices and the full ramen-ai-cmcp suite at 23 passed.

The assertion stays exact deliberately. A conformance integration test should break when the suite's finding set changes; that is the signal. What went wrong was that nobody acted on the signal, not that the test was strict.