build(deps): bump cmcp-runtime from 0.5.0 to 0.7.0 in /demos

[dependabot]

Bumps cmcp-runtime from 0.5.0 to 0.7.0.

Release notes

Sourced from cmcp-runtime's releases.

cmcp v0.7.0

Security

• TPM 2.0: verify_tpm_measurement listed a qualifying_data mismatch as unverified but still returned verified, so a genuine quote could be attached to a claim signed by any key. It also never compared the quote's pcrDigest with the claim's measurement, though docs/spec/tpm-security-model.md said it did. Both now fail the check.

Changed

• verify_trace_claim takes expected_launch_measurements, and cmcp verify takes a repeatable --launch-measurement. A hardware claim whose measurement is outside the set fails. With no set, a hardware claim is partially_verified with launch_measurement unverified: genuine hardware says what ran, not that it was approved, and a report from any guest image used to come out verified.

v0.6.0

cmcp-runtime 0.6.0. Full detail is in CHANGELOG.md.

Kill switch

• Blocks survive a restart and live in the audit database. The close that trips the switch returns its signed claim, and later calls get 403 KILL_SWITCH_TRIPPED (#665).
• A session stops at the call that trips the switch, not at session close (#666).
• Claims carry a gateway.kill_switch block, each refused call returns a signed receipt, and cmcp_verify.verify_kill_switch_refusal checks one against the other. kill_switch.enabled with no Agent Manifest now stops startup (#667).
• A compromised policy signing key can be revoked without a restart through CMCP_POLICY_SUCCESSOR_SIGNING_KEY and signing-key-revocations.json (#668).
• agent_manifest.revocation_list_path makes startup refuse a revoked Agent Manifest; a missing or malformed list stops startup instead of reading as empty (#689).

Also in this release

• Verifier-owned SNP platform policy in native, Azure and TRACE verification (#656).
• Opt-in exact-output disclosure bound to scoped owner signatures (#672).
• Monotonic session boundary, and session close and reset release stdio children and upstream caches (#629, #634).
• Two tool names that derive the same Cedar action are refused at catalog load (#671).
• Operator sensitivity ceilings at tool and response sinks.
• Linux agent confinement reference (#663).
• Paginated tools/list is read to the end before drift and provenance checks (#633).
• session_state_path is accepted and wired at startup, so the session sensitivity value can live in a shared SQLite store. An unopenable path stops startup with SESSION_STATE_STORE_UNAVAILABLE (#661).
• verify_audit_bundle requires a recorded session_reset at every session change, and code_digest refuses an installed file whose bytes differ from its RECORD entry (#689).

Behaviour changes

• A tools/call carrying _cmcp.execution_id is refused with execution_correlation_unavailable until execution correlation ships (#606).
• Session reset and catalog exception take CMCP_OPERATOR_TOKEN, required outside dev mode. Where it is unset they still accept the bearer token.

Changelog

Sourced from cmcp-runtime's changelog.

[0.7.0] - 2026-09-30

Security

• TPM 2.0: verify_tpm_measurement listed a qualifying_data mismatch as unverified but still returned verified, so a genuine quote could be attached to a claim signed by any key. It also never compared the quote's pcrDigest with the claim's measurement, though docs/spec/tpm-security-model.md said it did. Both now fail the check.
• Agent Manifest v0.2: the SDK appraised the COSE envelope, but the binding fields were read from the decoded dict the caller passed, and nothing checked that the two were the same document. A valid envelope paired with a dict carrying another policy or catalog hash bound. The dict must now equal the signed payload, and issuer_key_id is the key that verified the envelope instead of an empty string.

Added

• build_server(ctx, trace_gate=...): an optional pre-transport hook for verifier-issued TRACE tokens (cmcp_runtime.trace_gate.TraceGate). With a gate, POST /trace/challenge and POST /trace/admit are registered behind bearer auth, every tools/call needs a holder proof bound to its exact action, and the gate is rechecked and a receipt committed before any byte goes upstream. A gate requires enforcing mode. With no gate, the routes do not exist and the call path is unchanged.
• cmcp_runtime.manifest_catalog.manifest_catalog_binding: the Agent Manifest tool Merkle root (spec 3.2.3) computed from the catalog being served, kept separate from cMCP's sealed catalog digest.
• Experimental evidence-requirements-experimental-v1 manifest profile: the tool binding is checked against that Merkle projection, and the signed evidence requirements must also name the sealed catalog digest.

Changed

• verify_trace_claim takes expected_launch_measurements, and cmcp verify takes a repeatable --launch-measurement. A hardware claim whose measurement is outside the set fails. With no set, a hardware claim is partially_verified with launch_measurement unverified: genuine hardware says what ran, not that it was approved, and a report from any guest image used to come out verified.

Fixed

• An Agent Manifest that lists its tools in tool_manifest.tools could never bind: cMCP handed the SDK its sealed catalog digest, and from agent-manifest 0.13 the SDK compares catalog_hash with the Merkle root of that list. Such a manifest now binds when its list and root equal the projection of the catalog being served (cmcp_runtime.manifest_catalog). A manifest that omits tools is still compared with the sealed digest. verify_agent_manifest_binding takes runtime_catalog for this; without it a manifest with tools does not bind, which includes cmcp verify, since it has no catalog to project.

... (truncated)

Commits

• 6676188 chore(release): cmcp-runtime 0.7.0 (#711)
• 0ff0d12 fix(verify): require TPM key and PCR binding; pin launch measurements (#709)
• 368626f build(deps): bump pyjwt to 2.15.1 for CVE-2026-102274 and CVE-2026-101917 (#703)
• c67f3b4 ci: bump the codeql-action group with 4 updates (#700)
• 3bd5e6c ci: bump ruff from 0.16.7 to 0.16.8 (#693)
• 1759319 ci: bump starlette from 1.6.0 to 1.7.0 (#698)
• 0e1de4c ci: bump platformdirs from 4.11.8 to 4.11.12 (#690)
• d2a0122 ci: bump mkdocstrings-python from 2.0.8 to 2.0.9 (#691)
• f9b1f7c ci: bump wcwidth from 0.8.4 to 0.9.1 (#699)
• 0d71fbe ci: bump python from 3.11.15-slim-bookworm to 3.11.16-slim-bookworm (#697)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)