fix: ci actions, changelog urls, coc, opaque stub disclosure

.github/workflows/ci.yml

@@ -21,9 +21,9 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -43,7 +43,7 @@ jobs:
         run: pytest tests/unit/ -v --tb=short --cov=src --cov-report=xml
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v4
         with:
           fail_ci_if_error: false
 
@@ -53,9 +53,9 @@ jobs:
     if: github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.12"
 

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/publish.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.12"
 

.github/workflows/scorecard.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           fetch-depth: 0

CHANGELOG.md

@@ -17,5 +17,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `cmcp-verify` standalone verifier for validating TRACE Claims offline
 - Audit chain with Ed25519 signing for tamper-evident log integrity
 
-[Unreleased]: https://github.com/agentic-ai-foundation/cmcp-agentrust/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/agentic-ai-foundation/cmcp-agentrust/releases/tag/v0.1.0
+[Unreleased]: https://github.com/agentrust-io/cmcp/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/agentrust-io/cmcp/releases/tag/v0.1.0

CODE_OF_CONDUCT.md

@@ -0,0 +1,17 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We pledge to make participation in our community a harassment-free experience for everyone.
+
+## Our Standards
+
+Positive behavior: welcoming and inclusive language, respecting differing viewpoints, gracefully accepting constructive criticism, focusing on what is best for the community.
+
+Unacceptable behavior: sexualized language or imagery, trolling, insulting comments, personal or political attacks, public or private harassment, publishing others' private information without permission.
+
+## Enforcement
+
+Report instances of abusive behavior via [GitHub Security Advisories](https://github.com/agentrust-io/cmcp/security/advisories/new).
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

README.md

@@ -59,7 +59,7 @@ Agent -> cMCP Gateway -> Cedar Policy Engine (TEE) -> Tool
 | `tpm` | TPM 2.0 / vTPM (any Azure/AWS/GCP VM with Trusted Launch) | Medium |
 | `sev-snp` | AMD SEV-SNP (Azure DCasv5, AWS C6a Nitro) | High |
 | `tdx` | Intel TDX (Azure DCedsv5, GCP C3) | High |
-| `opaque` | Opaque Managed Runtime | Highest |
+| `opaque` | Opaque Managed Runtime | Highest | ⚠️ stub — `detect()` returns `False`, attestation not yet implemented |
 
 ## Status