build(deps): update agent-manifest requirement from >=0.11.2 to >=0.12.0

[dependabot]

Updates the requirements on agent-manifest to permit the latest version.

Release notes

Sourced from agent-manifest's releases.

python-v0.12.0

What's Changed

• ci: stop SBOM workflow pushing to protected main by @​imran-siddique in agentrust-io/agent-manifest#351
• fix(canonicalize): match RFC 8785 float formatting and UTF-16 key order by @​rajnisht7 in agentrust-io/agent-manifest#352
• docs(spec): require issuer key authorization by @​litzki-systems in agentrust-io/agent-manifest#367
• docs(spec): note Art. 50 runtime enforcement produces no attestable a… by @​FaresMallouli in agentrust-io/agent-manifest#366
• docs(spec): §3.5 clarify that approval_duration_seconds bounds the window, not the currency, of an approval by @​ioanavalea in agentrust-io/agent-manifest#355
• feat: add memory checkpoint behavioral assessment harness by @​Knapp-Kevin in agentrust-io/agent-manifest#369
• fix(attestation): reject expired certificates in hardware attestation chains by @​rajnisht7 in agentrust-io/agent-manifest#354
• fix(docs): resolve the standards-landscape diagram path, and check for it in CI by @​imran-siddique in agentrust-io/agent-manifest#371
• fix(transparency): fail closed on malformed Rekor responses by @​altrudev in agentrust-io/agent-manifest#359
• fix(tdx): bind verification to signed quote header by @​altrudev in agentrust-io/agent-manifest#374
• docs(examples): fix broken links to renamed/nonexistent spec and tutorial files by @​rajnisht7 in agentrust-io/agent-manifest#372
• fix(verify): negotiate version before current schema by @​altrudev in agentrust-io/agent-manifest#370
• fix(delegation): validate structure before interpretation by @​altrudev in agentrust-io/agent-manifest#357
• fix(delegation): bound child scope_grant ttl_seconds by absolute expiry by @​rajnisht7 in agentrust-io/agent-manifest#353
• feat(ci): vouch first-time contributors, and say the rule about understanding by @​imran-siddique in agentrust-io/agent-manifest#381
• test(tdx): run the committed real-hardware capture in CI by @​imran-siddique in agentrust-io/agent-manifest#382
• fix(security): pin all 35 third-party action refs to commit SHAs by @​imran-siddique in agentrust-io/agent-manifest#385
• fix(verify): make the verifier fail closed on attestation, timestamps and AK chains by @​imran-siddique in agentrust-io/agent-manifest#386
• fix(hitl): bind approval_method into the approval signature pre-image by @​imran-siddique in agentrust-io/agent-manifest#387
• fix(verify): stop a nested omission masking the full-binding requirement by @​imran-siddique in agentrust-io/agent-manifest#388
• fix(cert-chain): enforce pathLenConstraint (RFC 5280 §4.2.1.9) by @​rajnisht7 in agentrust-io/agent-manifest#384
• fix(trace): manifest binding can raise on malformed nested manifest shapes by @​kingztech2019 in agentrust-io/agent-manifest#380
• fix(plugins): verify_plugin_manifest_reference reads source_bundle before structural verification by @​kingztech2019 in agentrust-io/agent-manifest#379
• docs: make first manifest checks reproducible and clarify evidence by @​imran-siddique in agentrust-io/agent-manifest#389
• release: agent-manifest 0.12.0 by @​imran-siddique in agentrust-io/agent-manifest#390

New Contributors

• @​FaresMallouli made their first contribution in agentrust-io/agent-manifest#366
• @​ioanavalea made their first contribution in agentrust-io/agent-manifest#355
• @​Knapp-Kevin made their first contribution in agentrust-io/agent-manifest#369
• @​altrudev made their first contribution in agentrust-io/agent-manifest#359
• @​kingztech2019 made their first contribution in agentrust-io/agent-manifest#380

Full Changelog: agentrust-io/agent-manifest@python-v0.11.2...python-v0.12.0

Changelog

Sourced from agent-manifest's changelog.

[0.12.0] — 2026-09-05

Security

Five privately reported advisories, all the same shape: the integrated verifier reaching a passing verdict on evidence that does not support it.

• [SDK] attestation_verified now requires an independent hardware appraisal (GHSA-85fc-3g4g-fjjc, GHSA-qvg2-j8c5-5x3w). It was set by comparing the manifest's own manifest_hash_in_report against the locally computed manifest hash. That binding proves the report names this manifest; it proves nothing about hardware. For v0.1 the attestation block is outside the signing pre-image (spec 3.3) and for v0.2 COSE it rides in the unprotected header, so anyone holding a validly signed manifest could append a digest they computed themselves and satisfy enforce_attestation=True with no TPM quote, SNP report, TDX quote, certificate chain or trusted root involved.

  VerificationContext gains verified_attestation_manifest_hashes and attestation_evidence_manifest_id, on the same footing as the transparency receipt inputs. Breaking: a caller setting enforce_attestation=True without supplying an appraisal now gets ATTESTATION_UNAVAILABLE where it previously got VALID.

• [SDK] audit_key_sealed is enforced under enforce_attestation (GHSA-mqqg-9mpc-mpg7). Spec 5.3 requires it to be true. The engine read audit_chain_root but never this flag, so true, false and absent all returned the same VALID.

• [SDK] Expired manifests no longer verify when timestamp parsing fails (GHSA-7v9r-xprj-65j7). issued_at/expires_at are typed datetime, so Pydantic accepts epoch seconds and a lowercase zone designator and the schema gate passes them. The validity block re-parsed the raw strings with datetime.fromisoformat(), which rejects both, and swallowed the ValueError. The whole validity window was skipped and a correctly signed but expired manifest returned VALID. Timestamps now parse through the same adapter the model uses, and anything still unreadable fails closed. The memory-baseline TTL had the identical fail-open handler and is fixed too.

• [SDK] HITL approval_method is covered by the approval signature (GHSA-q8mp-875w-2w53, GHSA-wfv4-3xwh-9f2h). It decides Level-2 sufficiency but sat outside the pre-image, so a software-key approval could be relabelled hardware-key with its signature untouched. Breaking: approvals that carry approval_method must be re-signed. Approvals without one are unaffected, because the key is omitted from the canonical object when the field is absent.

• [SDK] TPM AK chains are appraised by the shared verifier (GHSA-mp83-94pc-7wqh). _verify_ak_chain() checked only "signed by the next" plus a pinned root, accepting non-CA intermediates and intermediates whose KeyUsage forbids certificate signing. It now delegates to verify_cert_chain(), the same appraisal the SNP and TDX paths use. Malformed

... (truncated)

Commits

• 9478b56 release: agent-manifest 0.12.0 (#390)
• 0e12e21 docs: make first manifest checks reproducible and clarify evidence (#389)
• 40c2ca8 fix(plugins): verify_plugin_manifest_reference reads source_bundle before str...
• ae643b5 fix(trace): manifest binding can raise on malformed nested manifest shapes (#...
• 9f1422e fix enforce pathLenConstraint (#384)
• 171bfb4 fix(verify): stop a nested omission masking the full-binding requirement (#388)
• 72a779b fix(hitl): bind approval_method into the approval signature pre-image (#387)
• 3927f08 fix(verify): make the verifier fail closed on attestation, timestamps and AK ...
• 6972494 fix(security): pin all 35 third-party action refs to commit SHAs (#385)
• 9348097 test(tdx): run the committed real-hardware capture in CI (#382)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)