ca2a/pyproject.toml at main · devdiv07/ca2a · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "ca2a-runtime"
version = "0.1.0a1"
description = "Confidential agent-to-agent runtime: attested, attenuated delegation and sealed peer channels for A2A"
readme = "README.md"
license = { text = "MIT" }
authors = [
    { name = "AgenTrust Contributors", email = "oss@agentrust-io.com" },
]
keywords = ["a2a", "agent-to-agent", "delegation", "tee", "attestation", "confidential-computing", "ai-agents"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
]
requires-python = ">=3.11"
dependencies = [
    "cryptography>=50.0",
    "pyyaml>=6.0",
    "cedarpy==4.8.7",
    # TRACE record models + RFC 8785 signing, reused rather than reimplemented
    # (see ROADMAP Tier 0). Pin a compatible minor; cross-repo skew is a known
    # risk documented in LIMITATIONS.md.
    "agentrust-trace>=0.5",
    # Shared hardware-attestation verification (generic cert-chain verifier,
    # SNP/TDX/TPM primitives) consumed via PyPI instead of duplicated per repo.
    "agent-manifest>=0.10",
    "rfc8785>=0.1",
]

[project.optional-dependencies]
# TPM quote collection. Only the collector needs these bindings; verifying a
# peer's quote does not, so this stays out of the base dependencies.
tpm = [
    "tpm2-pytss>=2.2; sys_platform == 'linux'",
]
# Bridge to the official A2A SDK (ca2a_runtime.transport.a2a_sdk). Optional:
# the reference transport and the profile itself need no A2A implementation, and
# the base install stays dependency-light.
a2a-sdk = [
    "a2a-sdk>=1.1,<2",
    "aiohttp>=3.14.3",
]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "pytest-cov>=5.0",
    "ruff>=0.4",
    "mypy>=1.10",
    "types-pyyaml",
    "bandit[toml]>=1.7",
    "pip-audit>=2.6",
    # Conformance suite: asserts emitted records pass the TRACE Level checks.
    "agentrust-trace-tests>=0.4,<0.5",
    # So tests/unit/test_a2a_sdk_bridge.py runs in CI rather than skipping. A
    # bridge whose tests only ever skip is a bridge nobody has exercised.
    "a2a-sdk>=1.1,<2",
    "aiohttp>=3.14.3",
]

[project.scripts]
ca2a = "ca2a_runtime.cli:main"

[project.urls]
Homepage = "https://github.com/agentrust-io/ca2a"
Repository = "https://github.com/agentrust-io/ca2a"
Documentation = "https://github.com/agentrust-io/ca2a/tree/main/docs"
"Bug Tracker" = "https://github.com/agentrust-io/ca2a/issues"

[tool.hatch.build.targets.wheel]
packages = ["src/ca2a_runtime", "src/ca2a_verify"]

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
addopts = "-v --tb=short"
pythonpath = ["src"]

[tool.ruff]
src = ["src"]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "W", "I", "UP", "B", "C4", "PIE", "T20", "RET", "SIM"]
ignore = ["E501"]

[tool.ruff.lint.per-file-ignores]
"src/ca2a_runtime/benchmarks.py" = ["T201"]
"src/ca2a_runtime/cli.py" = ["T201"]
"scripts/gen_example_chain.py" = ["T201"]
"scripts/gen_agt_evidence.py" = ["T201"]
"examples/**/*.py" = ["T201"]

[tool.bandit]
skips = ["B101"]

[tool.coverage.run]
source = ["src"]
omit = ["*/cli.py", "*/benchmarks.py"]

[tool.coverage.report]
fail_under = 70

[tool.mypy]
python_version = "3.11"
strict = true
ignore_missing_imports = true
warn_return_any = false
files = ["src/ca2a_runtime", "src/ca2a_verify"]

[[tool.mypy.overrides]]
module = ["ca2a_runtime.tee.sev_snp", "ca2a_runtime.tee.tdx", "ca2a_runtime.tee.tpm", "ca2a_runtime.cedar", "ca2a_verify.tdx", "ca2a_verify.tpm", "ca2a_runtime.channel.sealed"]
warn_unused_ignores = false