parmana-server: pin parmana 1.6.0 and give exact reproduction steps

integrations/parmana-server/README.md

@@ -38,12 +38,20 @@ Both keys were generated for the run and do not chain to any trusted issuer.
 
 ## Running it
 
+From this directory, in a clean environment, with released packages only (`parmana` 1.6.0 and `agentrust-trace`
+0.11.0 from PyPI):
+
 ```
+python -m venv .venv && . .venv/bin/activate
 pip install -e ".[test]"
 python examples/emit_references.py
+git diff --exit-code fixtures/references.json
 python -m pytest tests
 ```
 
+Expected: `emit_references.py` prints one line per reference (four in all), `git diff` prints nothing because the
+output matches the committed `references.json` byte for byte, and pytest reports 18 passed.
+
 `emit_references.py` checks every record's signature, then writes `fixtures/references.json`. The tests check every
 signature, that a changed amount, outcome or approval limit no longer verifies, that the approval in 01 is the one the
 Trust Record was signed over, that all three decisions name the same policy content hash, and that

integrations/parmana-server/integration.yaml

@@ -26,4 +26,4 @@ tested_against:
   agentrust-trace: "0.11.0"
   # The fixtures are one run of Parmana's refund evaluation at commit
   # ac22a7ed594b4a527504ce43841595c1a62f3046 (fixtures/report.json). The checks use the
-  # published parmana 1.5.0 SDK (Apache-2.0) for Execution Trust Records.
+  # published parmana 1.6.0 SDK (Apache-2.0) for Execution Trust Records.

integrations/parmana-server/pyproject.toml

@@ -8,7 +8,7 @@ version = "0.1.0"
 description = "Parmana authorization decisions as TRACE authorized-intent and approval-outcome references"
 requires-python = ">=3.11"
 license = "Apache-2.0"
-dependencies = ["parmana==1.5.0", "rfc8785", "cryptography"]
+dependencies = ["parmana==1.6.0", "rfc8785", "cryptography"]
 
 [project.optional-dependencies]
 test = ["pytest", "agentrust-trace==0.11.0"]