chore(release): 0.6.0, and stop __version__ drifting

[imran-siddique]

What this changes

Cuts 0.6.0 and fixes a version bug that has been shipping for four releases.

The bug

__version__ was a hardcoded literal. It drifted from pyproject.toml at #36 and was never corrected, so v0.3.0, v0.4.0, v0.5.0 and v0.5.1 each published a wheel reporting 0.2.0 at runtime. Anyone pinning or logging on agentrust_trace.__version__ got the wrong answer, and nothing anywhere failed.

It now derives from installed package metadata, so a built artifact cannot disagree with itself.

tests/test_version.py guards what is still possible to get wrong:

• test_version_is_not_hardcoded — the actual regression, and environment independent, so it is the test that holds the line
• test_changelog_documents_the_declared_version — the tag is what publishes to PyPI, so a missing changelog section has to fail before the tag
• test_declared_version_is_semver
• test_module_version_matches_pyproject — skips unless the installed distribution resolves to this source tree, since a working copy with a stale PyPI wheel alongside it would otherwise report a mismatch that says nothing about the code

What is in 0.6.0

PR
#130	TraceSandboxAdapter for sandboxed agent runtimes
#125	verify_record() enforces the v0.2 profile cutover
#126	Portable RFC 8785 conformance vectors
#122	Conformance vectors for seven unexercised receipt rules
#98	Acta decision receipts crosswalk
this	Version fix, description fix

Why MINOR and not MAJOR

#125 makes verify_record() reject records it previously accepted, which looks breaking. Under this project's own policy MAJOR means "breaking changes to wire format or required Trust Record fields", and #125 changes neither: it enforces a cutover spec/trace-v0.2.md §2 already declared normative and the changelog already announced. MINOR is the right call, and the behaviour change is prominent in the 0.6.0 notes.

Also

• Package description said "TRACE v0.1"; the PyPI summary has been advertising the superseded profile.
• One isinstance call in sign.py modernised (UP038). The pinned CI ruff does not flag it yet, a current ruff does, and a routine dependency bump would otherwise turn CI red.

Checklist

• DCO sign-off
• CHANGELOG.md section cut for 0.6.0
• 190 passed, 1 skipped; ruff and mypy clean
• Tag v0.6.0 after merge, which triggers publish.yml and OIDC trusted publishing

🤖 Generated with Claude Code