release: 0.1.0-alpha.3

[imran-siddique]

Release preparation for 0.1.0-alpha.3, following steps 1 and 2 of RELEASING.md.

What is in this release

All four already merged to main:

PR
#46	EvidenceAccumulator no longer deadlocks on a reentrant append/seal
#47	four fast-uri advisories patched, tag interpolation removed from release.yml
#49	a failing signer is a real key, not a duck type
#48, #50	actionlint, a test-environment guard, and hash-pinned CI installs

Why this cannot wait for the next feature

v0.1.0-alpha.2 no longer passes its own test suite on a clean install, and nothing in this repository changed to cause it.

agentrust-trace 0.10.0 was published to PyPI on 2026-09-06. The release pins agentrust-trace>=0.9,<1, so a fresh install now resolves to it, and 0.10.0 requires a real Ed25519PrivateKey where tests/test_trace_adapter_refusals.py passed a duck-typed double. Measured on clean clones:

tag	agentrust-trace	result
v0.1.0-alpha.2	0.10.0	1 failed, 108 passed, 2 skipped
v0.1.0-alpha.2	0.9.0	109 passed, 2 skipped
this branch	0.10.0	112 passed, 2 skipped

Pinning back to 0.9.0 restores the old result exactly, which is what identifies the cause. #49 fixed it on main the same day; this release is what puts the fix somewhere a reader can install.

On the moved digests

spec/VERSION is the contract version both package versions derive from, so bumping it changes the wire spec_version, which sits inside the RFC 8785 bytes that get hashed. compatibility/golden/evidence-chain.json was regenerated from the SDK rather than hand-edited, and the tool-transcript hash is asserted independently by Python and TypeScript, which agree on sha256:6e27536….

Two changelog defects, fixed here rather than left

The 0.1.0-alpha.1 section claimed the wrong contract version. It read "Initial 0.1.0-alpha.2 event contract", which is not a thing that could have been true of the alpha.1 release. The line has been rewritten twice by version bumps, first to 0.1.0-alpha.1 by #41 and then to 0.1.0-alpha.2 by #45, because a global replace of the version string does not know that a changelog is a historical record. Restored to 0.1.0-alpha.1, and the bump in this PR was applied file by file with CHANGELOG.md held out.

#46's entry was filed under the wrong release. It appended a ### Fixed section to the end of the file, which put it inside the 0.1.0-alpha.1 section, so the changelog said a September fix shipped in the August release. Moved into 0.1.0-alpha.3 where it belongs.

Also worth noting for whoever cuts alpha.4: tests/test_repository_gates.py holds two version tables that look alike and are not. The spelling table is a set of vectors and gains an entry per phase; the validate_tag assertions track the declared contract and must move. Only the second kind was changed here.

Verification

Clean clone, fresh venv, pip install -e ".[otel,trace,test]" resolving agentrust-trace 0.10.0 and opentelemetry 1.44.0.

Gate	Result
check_versions	contract=0.1.0-alpha.3 python=0.1.0a3 npm=0.1.0-alpha.3
check_release_tag v0.1.0-alpha.3	pass
npm_dist_tag	alpha
check_schemas	8 bundled schemas match normative bytes
check_typescript_schemas	pass
check_otel_compatibility	16 span attributes, 8 metrics, 6 event families
Conformance fixtures	13/13
Python tests	112 pass, 2 skipped
TypeScript tests	41 pass

After this merges

1. Create the GitHub prerelease tagged v0.1.0-alpha.3 targeting main.
2. Approve the pypi and npm deployment jobs after inspecting the source commit and built artifacts.
3. Confirm both registry versions and provenance before announcing.

🤖 Generated with Claude Code

https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j