[drk-ram]

What

Reject RFC 7517/7518/8037 private JWK members and non-canonical base64url keys in ca2a_verify.dag and ca2a_runtime.agent_manifest, reject lone UTF-16 surrogates in ca2a_runtime.canonical, and reject duplicate JSON object keys in ca2a_verify.verify.

Why

Closes items 1-3 of #267 (item 4 is covered by #269).

Security impact

Prevents private key material (d, p, q, dp, dq, qi, oth, k) and malleable base64url public keys from being accepted in TRACE DAG verification and Agent Manifest trust anchors, prevents lone UTF-16 surrogates from leaking UnicodeEncodeError during RFC 8785 canonicalization, and blocks duplicate-key JSON smuggling in chain and revocation files.

Test plan

• pytest passes (pytest tests/unit/test_agent_manifest_cose.py tests/unit/test_canonical.py tests/unit/test_trace_binding.py tests/unit/test_verify.py -q: 105 passed)
• ruff check and ruff format --check pass (All checks passed!)
• mypy passes (mypy --strict src/ca2a_runtime/canonical.py src/ca2a_verify/verify.py: Success)
• Manual test performed (verified private JWK, non-canonical base64url, lone surrogate, and duplicate-key rejection cases)

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Bounded review at 365bed8. Independently ran the four test modules named in the description against fetched, pinned repository source on Linux/Python 3.12: 105 passed, not 176. Ruff passes for all four changed source modules. Please reconcile the description's count or provide the additional selection/revision behind 176.

The inspected changes preserve InvalidCredential/InvalidRevocation translation for duplicate JSON members, reject private JWK parameters before decoding, enforce canonical 32-byte DAG keys, and give an exact ValueError for surrogate input. Existing accepting cases and the added refusal cases pass. No additional blocker found in this bounded review; #269 remains a separate freshness change.

This was not a hash-locked full-suite run (dependencies included agent-manifest 0.15.0, agentrust-trace 0.11.0 and trace-tests 0.6.2). Source import paths were checked. Hosted full CI, types/security checks and the two-maintainer requirement for ca2a_verify remain separate; I am not claiming merge readiness or hardware acceptance. Reviewed with OpenAI Codex.

[dinakarjs]

Expanded exact-head validation: 879 unit/conformance tests passed, 11 skipped, 90.53% coverage; Ruff lint, mypy (47 files), and Bandit passed in a hash-locked editable-install environment. The required Ruff formatting gate fails in four changed test files: test_agent_manifest_cose.py, test_canonical.py, test_trace_binding.py, and test_verify.py. I prepared commit c3a9dd3 on dinakarjs/ca2a branch fix/270-format-gate for adoption. The four ASTs are unchanged and the formatting gate then passes across all 107 files. The existing implementation still needs its hosted checks and independent maintainer approval.

[drk-ram]

Thank you @dinakarjs! Applied
uff format across the four test files (
uff format --check src tests passes across all 107 files) and updated the PR description to state the exact 4-file count (105 passed).

[carloshvp]

Reviewed exact head b4bb370703e176920d0aaa4cebcb5f8915ac6db7 in an isolated checkout.

Reviewed public-only Ed25519 JWKs, canonical encodings and key lengths, controlled lone-surrogate rejection and duplicate-member rejection in credential/revocation file loading. The updated formatting and expanded malformed-input cases are present. Valid signed-chain and COSE controls remain passing; no blocking source finding in this scope.

Fresh hash-locked Python 3.12.10 validation: 821 unit tests passed, 16 skipped; pip check, Ruff, mypy, Bandit and diff whitespace checks passed. Every PR commit has a sign-off. Hosted CI and the required maintainer/security approval inventory remain separate from this source approval.

Reviewed with OpenAI Codex.