Prepare MRMA 0.3.5 release (#9)

Advance package and CLI versions to 0.3.5 and document the dependency-contract maintenance release.

The protected CodeQL, container, distribution, evidence-quality, and six-platform Python matrix passed.

Author: 0xmrma

CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes are documented here. MRMA follows semantic versioning for the CLI and uses an
 independent version in each machine-readable evidence schema.
 
+## 0.3.5 - 2026-07-14
+
+### Dependency Contract
+
+- Published package metadata now requires Tomli 2.4.1 or newer on Python 3.10, matching the
+  runtime dependency audit and carrying the parser's bound on pathological key-part growth.
+- Added a parsed PEP 508 contract test requiring the runtime audit manifest to exactly match
+  published runtime dependencies, including version ranges and environment markers.
+
+### Maintenance And Supply Chain
+
+- Updated the supported Rich range to include Rich 15 and pinned Rich 15.0.0 in the reproducible
+  container dependency set. MRMA's Python 3.10 floor is compatible with the release.
+- Updated all workflow checkouts to the SHA-pinned Actions Checkout 7 release.
+- Raised the audit environment's Tomli floor to 2.4.1 and declared the requirement parser as an
+  explicit development dependency.
+
 ## 0.3.4 - 2026-07-14
 
 ### HTTP Semantic Correctness

README.md

@@ -7,7 +7,7 @@ across a layered HTTP system, then helps reduce that signal to the smallest resp
 It is not a generic vulnerability scanner and it does not treat a one-off response difference as
 a finding.
 
-> Status: `0.3.4` research preview. `mrma experiment` has a conservative evidence contract;
+> Status: `0.3.5` research preview. `mrma experiment` has a conservative evidence contract;
 > legacy survey and minimization commands do not yet share this oracle.
 
 ## The flagship workflow
@@ -122,14 +122,14 @@ MRMA is published as a non-root multi-architecture container through GitHub Cont
 the Python base is pinned by OCI digest and build/runtime dependencies are exact and hash-verified.
 
 ```bash
-docker pull ghcr.io/0xmrma/mrma:0.3.4
-docker run --rm ghcr.io/0xmrma/mrma:0.3.4 --version
+docker pull ghcr.io/0xmrma/mrma:0.3.5
+docker run --rm ghcr.io/0xmrma/mrma:0.3.5 --version
 ```
 
 Run an authorized experiment from the container:
 
 ```bash
-docker run --rm ghcr.io/0xmrma/mrma:0.3.4 \
+docker run --rm ghcr.io/0xmrma/mrma:0.3.5 \
   experiment --url https://example.com --set-header "X-Test: 1"
 ```
 

mrma/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.3.4"
+__version__ = "0.3.5"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mrma"
-version = "0.3.4"
+version = "0.3.5"
 description = "Evidence-driven HTTP trust-boundary experimentation for authorized security research"
 readme = "README.md"
 license = "MIT"