Bump to 2.6.5: type operator_handle on the assess response (#75)

## Summary

`/v1/assess` now returns `operator_handle` on the operator-token path: a
stable, pairwise handle for the account behind the presented credential.
Typed here so SDK consumers can read it without casting.

It is the value to key durable state on. An `opc_` lives 24h and rotates
silently off a 90-day refresh, so anything keyed on the token instance
is stranded every time one rotates, and revoking a leaked token would
forfeit what it was holding. The handle derives from the account
instead, and is pairwise per calling account so handles never correlate
across merchants.

Type-only change: no runtime behavior, no new request field. Against an
older API the field is simply absent.

## Type of change

- [ ] Bug fix (no breaking change)
- [x] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

Additive: one optional field on the assess response type. No migration
for existing callers.

## Test plan

Existing suites run clean against the change; no behavior to add tests
for, since nothing but the type surface moved. Node: lint, typecheck,
166 passed / 9 skipped. Python: ruff, ty, 183 passed / 8 skipped at 100%
coverage.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Take ty 0.0.70, bump to 2.6.4 (#74)

## Summary

Routine dev-tooling sweep ahead of the commerce-side release chain: ty
0.0.69 to 0.0.70 (the only update the lock resolved). Version bumped to
2.6.4 for the patch release.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

Unchanged. ty is a dev-group type checker; no runtime surface is
touched.

## Test plan

ruff check + format, ty (clean on the new version), vulture, and the
full suite (183 passing, 8 skipped) all green.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Refresh the dev toolchain lock, release 2.6.3 (#72)

## Summary

Routine dependency pass over the whole tree. Only one package had a
newer version inside its declared range: `ty` 0.0.65 to 0.0.66, a
dev-group type checker. Everything else is already current.

Reported so the next pass does not re-derive it: `httpx` (the single
runtime dependency) is current within `>=0.25.0,<1.0.0`, and the
lockfile carries no advisories under either scanner.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. `pyproject.toml` is untouched; the diff is `uv.lock` alone. `ty`
is a dev-group tool that no consumer resolves, so no release is needed
and no caller has to act.

## Test plan

- `uv sync --all-extras --all-groups --upgrade`, then:
- `uv run ruff check .` all checks passed
- `uv run ruff format --check .` 21 files already formatted
- `uv run ty check agentscore/` all checks passed
- `uv run pytest tests/`: 183 passed, 8 skipped, 100.00% coverage (gate
is 95%)
- osv-scanner v2.4.0 over `uv.lock`: no issues found

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Sweep deps and cut 2.6.2 (#71)

## Summary

Dependency sweep for this repo, plus a version bump so it can be
released.

- `coverage` 7.15.2 to 7.15.3, the only available bump.
- Version to 2.6.2.

Same caveat as the node SDK, and it decides whether this is worth
publishing: nothing here reaches a consumer. The only commit since
v2.6.1 is a one-line `ci.yml` change and coverage is a dev dependency,
so the published wheel is unchanged.

`uv.lock` was re-locked after the version bump, not just after the
dependency change. The lock embeds the project's own version, so a
`pyproject.toml` bump leaves it stale with nothing erroring and no gate
noticing: the two files simply disagree about what the package is. It
was sitting at 2.6.1 and `uv lock` moved it to 2.6.2.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

**None.** No exported class, function signature, wire format, or
response shape changed. The published wheel is unchanged; the only
difference is a dev dependency.

No migration for callers. Both consumers in this workspace
(`core/store`, `python-commerce`) declare `agentscore-py>=2.6.1`, which
already accepts 2.6.2, so no manifest edit is required downstream.

## Test plan

No tests added, because no behavior changed. The existing suite was run
to confirm the bump breaks nothing:

- `uv run pytest`: 183 passed, 8 skipped, 100% coverage against a 95%
floor
- `ruff check` and `ruff format --check`: clean
- `uv run ty check`: clean
- `uv run vulture . vulture_whitelist.py --min-confidence 80 --exclude
.venv`: clean

Vulture is run through the project's exact CI invocation rather than a
bare `vulture`, which reports low-confidence findings the project
deliberately filters out and would read as a regression that is not
there.

Reproduce with `uv sync --all-extras --all-groups` followed by those
four commands.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
(not applicable, public surface unchanged)
- [x] No secrets, credentials, or personal data in the diff or the tests

deps: ruff 0.16.1, ty 0.0.65 (#69)

## Summary

Routine dev-tooling bumps from the workspace-wide maintenance sweep:
`ruff` 0.16.0 to 0.16.1 and `ty` 0.0.63 to 0.0.65. Lockfile only, no
source changes.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. Both are lint/typecheck tooling; no exported type, signature, or
wire format changes, so callers have no migration to make.

## Test plan

Ran the repo's full Python gate set with exit codes read directly: `ruff
check` clean, `ruff format --check` clean at 21 files, `ty check` clean,
`pytest` 183 passed with 8 skipped, and `vulture --min-confidence 80`
clean over the package. Every sync used `--all-extras --all-groups`
rather than a bare `uv sync`, which would resolve base deps only and
quietly strip the venv's extras and dependency groups.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Sync uv.lock to 2.6.0 (#68)

## Summary

The version bump to 2.6.0 changed `pyproject.toml` but not the matching
self-version entry in `uv.lock`, so the lock still said 2.5.3. Any `uv
sync` regenerates it, which leaves an unrelated dirty file in the next
person's working tree.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. Lockfile only.

## Test plan

`uv run pytest` (183 pass, 100% coverage), `uv run ruff check`, `uv run
ty check` all clean before tagging the release.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Dep sweep: uv lock refresh (#63)

Part of today's org-wide dependency pass. Full-resolution upgrade via uv
sync --upgrade --all-extras --all-groups: certifi 2026.7.22, ty 0.0.62,
lockfile transitives. No manifest range changes; no pinned deps moved.
183 tests green at 100% coverage; ruff, ty, and vulture clean.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

chore(deps+release): in-range upgrades -> v2.5.2 (#60)

In-range dependency upgrades (uv.lock only; no pyproject constraint
changes):

- anyio 4.14.1 -> 4.14.2
- coverage 7.15.0 -> 7.15.2
- ruff 0.15.21 -> 0.15.22
- ty 0.0.58 -> 0.0.60 (floats on a range here; re-verified clean)

Verified locally: ruff check, ruff format --check, ty check (clean at
0.0.60), vulture, pytest (183 passed, 100% coverage).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Refresh deps and actions, fix the agent_memory quickstart fixture; v2…

….5.1 (#58)

- Lockfile refresh within existing ranges (`uv sync --upgrade
--all-extras --all-groups`): lefthook 2.1.10, ruff 0.15.21, ty 0.0.58.
No pyproject range changes; httpx stays within its `<1.0.0` bound.
- `astral-sh/setup-uv` bumped v8.3.0 → v8.3.2 in ci/publish/security
workflows (`pypa/gh-action-pypi-publish` already at latest; the rest are
floating major tags).
- The `agent_memory.quickstart` test fixture pointed at a docs URL that
404s; it now mirrors the URL the API actually emits (the AgentScore
Passport guide).
- Version bumped to 2.5.1 for a routine patch release.

Full gate: ruff check + format clean, ty clean, 183 tests passed,
vulture (with whitelist) clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

chore: canonicalize on www.agentscore.com; refresh deps and CI

Canonicalize issuer and UCP namespace on www.agentscore.com / com.agentscore, refresh deps within constraints, bump CI actions (setup-uv v8.3.0, cache v6, checkout v7). Version 2.5.0.