From 7f06c0beed0ecd029634eaf2d20cc693956ca299 Mon Sep 17 00:00:00 2001
From: Imran Siddique <imran.siddique@opaque.co>
Date: Sun, 7 Jun 2026 14:03:51 -0700
Subject: [PATCH] fix: pin CI actions to v4, fix CHANGELOG URLs, add CoC, note
 opaque provider stub status

---
 .github/workflows/ci.yml        | 10 +++++-----
 .github/workflows/codeql.yml    |  2 +-
 .github/workflows/publish.yml   |  2 +-
 .github/workflows/scorecard.yml |  2 +-
 CHANGELOG.md                    |  4 ++--
 CODE_OF_CONDUCT.md              | 17 +++++++++++++++++
 README.md                       |  2 +-
 7 files changed, 28 insertions(+), 11 deletions(-)
 create mode 100644 CODE_OF_CONDUCT.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 138c648e..3b80cb08 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,9 +21,9 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -43,7 +43,7 @@ jobs:
         run: pytest tests/unit/ -v --tb=short --cov=src --cov-report=xml
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v4
         with:
           fail_ci_if_error: false
 
@@ -53,9 +53,9 @@ jobs:
     if: github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ab0a98c7..68a67335 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a1df7461..c437723a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5604c368..a7bd807d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4afd3b82..011e411c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,5 +17,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `cmcp-verify` standalone verifier for validating TRACE Claims offline
 - Audit chain with Ed25519 signing for tamper-evident log integrity
 
-[Unreleased]: https://github.com/agentic-ai-foundation/cmcp-agentrust/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/agentic-ai-foundation/cmcp-agentrust/releases/tag/v0.1.0
+[Unreleased]: https://github.com/agentrust-io/cmcp/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/agentrust-io/cmcp/releases/tag/v0.1.0
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 00000000..ed71c9bc
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,17 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We pledge to make participation in our community a harassment-free experience for everyone.
+
+## Our Standards
+
+Positive behavior: welcoming and inclusive language, respecting differing viewpoints, gracefully accepting constructive criticism, focusing on what is best for the community.
+
+Unacceptable behavior: sexualized language or imagery, trolling, insulting comments, personal or political attacks, public or private harassment, publishing others' private information without permission.
+
+## Enforcement
+
+Report instances of abusive behavior via [GitHub Security Advisories](https://github.com/agentrust-io/cmcp/security/advisories/new).
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.
diff --git a/README.md b/README.md
index 1742281b..9ff4d604 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ Agent -> cMCP Gateway -> Cedar Policy Engine (TEE) -> Tool
 | `tpm` | TPM 2.0 / vTPM (any Azure/AWS/GCP VM with Trusted Launch) | Medium |
 | `sev-snp` | AMD SEV-SNP (Azure DCasv5, AWS C6a Nitro) | High |
 | `tdx` | Intel TDX (Azure DCedsv5, GCP C3) | High |
-| `opaque` | Opaque Managed Runtime | Highest |
+| `opaque` | Opaque Managed Runtime | Highest | ⚠️ stub — `detect()` returns `False`, attestation not yet implemented |
 
 ## Status