fix: read __version__ from distribution metadata (#50)

`__version__` was a second hardcoded literal alongside `pyproject.toml` and
never moved, so it sat at "0.2.0" through both the 0.3.0 and 0.4.0 releases.
`cli.py` passes it to `@click.version_option`, so:

    $ trace-tests --version
    trace-tests, version 0.2.0          # from a 0.4.0 install
    $ python -c "import importlib.metadata as m; \
        print(m.version('agentrust-trace-tests'))"
    0.4.0

Worse than a cosmetic slip. The v0.2 profile cutover shipped in 0.4.0 and a
0.2.x suite rejects every v0.2 record, so `--version` is precisely the command
someone runs to work out whether their suite matches their producer. It was the
one command that could not answer, and it actively misled: a correctly upgraded
user is told they still have the version that cannot verify their records.

Found while running the suite against a freshly minted record: the record failed
TR-ENV on the profile sentinel, and `--version` reported 0.2.0 both before and
after upgrading to 0.4.0, so it gave no signal that the upgrade had worked.

Fix reads the version from installed distribution metadata, removing the
duplicate literal so it cannot fall behind a release again. Stdlib only, no new
dependency. A source tree importable without an install has no metadata to read,
so that falls back to "0.0.0+unknown" rather than guessing a number and
reintroducing the drift.

Two regression tests: `--version` output must contain the distribution version,
and `__version__` must equal it, which fails if anyone restores a literal.

Verified: `pip install -e .` then `trace-tests --version` -> 0.4.0.
Full suite 118 passed, 5 xpassed (the 5 are pre-existing
`xfail(strict=False)` hardware-TEE cases in tests/test_level2.py, untouched).

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: imran-siddique

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Fixed
+
+- **`--version` reported the wrong version.** `__version__` was a second hardcoded literal alongside `pyproject.toml` and never moved, so it sat at `0.2.0` through both the 0.3.0 and 0.4.0 releases: `trace-tests --version` printed `0.2.0` from a 0.4.0 install while `importlib.metadata` correctly returned `0.4.0`. It is now read from installed distribution metadata, so there is one source of truth and the value cannot fall behind a release again.
+
+  This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so `--version` is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer.
+
 ## v0.4.0 — 2026-07-28
 
 ### Changed

src/trace_tests/__init__.py

@@ -1,3 +1,20 @@
 """TRACE conformance test suite."""
 
-__version__ = "0.2.0"
+from importlib.metadata import PackageNotFoundError, version
+
+# Read the version from installed distribution metadata rather than restating it
+# here. `pyproject.toml` is what the build and PyPI publish, so a second literal
+# in this file is a copy that can fall behind silently: it sat at "0.2.0" through
+# both the 0.3.0 and 0.4.0 releases, so `trace-tests --version` reported 0.2.0
+# from a 0.4.0 install. That is worse than cosmetic, because the v0.2 profile
+# cutover landed in 0.4.0 and `--version` is the command someone runs to find out
+# whether they have a suite that accepts v0.2 records.
+try:
+    __version__ = version("agentrust-trace-tests")
+except PackageNotFoundError:  # pragma: no cover - source tree with no install
+    # Importable without being installed (e.g. PYTHONPATH against a checkout).
+    # There is no metadata to read here, and guessing a number would reintroduce
+    # the drift this exists to prevent.
+    __version__ = "0.0.0+unknown"
+
+__all__ = ["__version__"]

tests/unit/test_cli.py

@@ -57,3 +57,29 @@ def test_partial_cmcp_envelope_is_rejected(tmp_path):
     result = CliRunner().invoke(main, ["verify", "--record", str(p), "--level", "0"])
     assert result.exit_code == 2, result.output
     assert "partial cmcp-runtime envelope" in result.output
+
+
+def test_version_matches_distribution_metadata():
+    """`--version` must report the installed distribution version.
+
+    `__version__` was a second hardcoded literal alongside `pyproject.toml` and
+    fell behind through two releases, so a 0.4.0 install reported 0.2.0. Since
+    the v0.2 profile cutover shipped in 0.4.0, `--version` was the one command
+    that could not tell you whether your suite accepts v0.2 records.
+    """
+    from importlib.metadata import version
+
+    expected = version("agentrust-trace-tests")
+    result = CliRunner().invoke(main, ["--version"])
+
+    assert result.exit_code == 0, result.output
+    assert expected in result.output, f"expected {expected!r} in {result.output!r}"
+
+
+def test_dunder_version_is_not_a_stale_literal():
+    """Guard against reverting to a hardcoded `__version__`."""
+    from importlib.metadata import version
+
+    import trace_tests
+
+    assert trace_tests.__version__ == version("agentrust-trace-tests")