[drk-ram]

What

Enforce ^sha384:[0-9a-f]{96}$ measurement format and valid hex report_data_hex in verify_tdx_measurement, and guard non-dict inputs and exact digest lengths in verify_embodied_action_evidence.

Why

Closes #803.

Security impact

Ensures malformed TDX measurement strings or report_data_hex values are classified accurately (invalid_measurement_format and report_data_mismatch), and prevents unhandled AttributeError / TypeError when verify_embodied_action_evidence receives non-dict inputs or malformed claim_json structures.

Test plan

• pytest passes (pytest tests/unit/test_tdx_verify.py tests/unit/test_embodied_action_evidence.py -q)
• ruff check passes (ruff check src/cmcp_verify/tdx.py src/cmcp_verify/embodied_action.py tests/unit/test_tdx_verify.py tests/unit/test_embodied_action_evidence.py)
• mypy passes (mypy src/cmcp_verify/tdx.py src/cmcp_verify/embodied_action.py)
• Manual test performed

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head 65133135cee9c487036649a2997ca95c53fd81c2 in an isolated checkout.

The measurement parser now requires the declared lowercase SHA-384 format, malformed report data follows the controlled mismatch path, and embodied-action evidence rejects malformed containers and digest values without treating receipt validity as proof of policy authorization or physical completion. No blocking finding in the changed paths.

Local hash-locked Python 3.12.10 validation: 2,528 unit tests passed, 20 skipped; pip check, Ruff, mypy and Bandit passed. All PR commits have sign-offs. git diff --check notes one extra blank line at test_tdx_verify.py EOF, a nonblocking cleanup. Hosted CI and required maintainer gates still need completion.

Reviewed with OpenAI Codex.

[noah-ing]

Reviewed current head 65133135cee9c487036649a2997ca95c53fd81c2. The new shape guards treat a supplied but malformed TRACE Claim like no Claim at all. With the repository’s valid signed ROS2 evidence fixture, claim_json={"trace": None, "gateway": None} returns verified=True, no failures or warnings, and omits all policy, catalog, and agent cross-bindings. The added test currently asserts that success. Please preserve None as the explicit no-Claim mode, but return a nonverified result when a supplied Claim has malformed sections, and add a negative regression for that distinction. This is a fail-closed helper-contract concern; I have not shown a bypass of the documented flow that verifies the full TRACE Claim first.

The TDX format changes behaved as intended. Local exact-head validation: 2,528 unit tests passed, 20 skipped; focused negative fixture replay passed. Hosted CI is blocked by the existing locked-dependency audit, and required governance checks remain outstanding.

[drk-ram]

Thanks @noah-ing and @carloshvp! Updated verify_embodied_action_evidence in src/cmcp_verify/embodied_action.py so claim_json=None remains the explicit no-Claim mode while any supplied claim_json with non-object claim_json, missing/malformed trace.policy.bundle_hash, or missing/malformed gateway.catalog.hash records a failure and returns verified=False (covered in tests/unit/test_embodied_action_evidence.py), and trimmed the EOF blank line in tests/unit/test_tdx_verify.py.

[noah-ing]

Thanks for the follow-up. I checked head 944c03c6700410f1382d843e2c71162259834913 with the repository’s signed ROS2 external-evidence fixture. The malformed supplied trace/policy/catalog cases now fail, while claim_json=None remains the explicit no-Claim mode. One supplied malformed section still silently drops a binding: with valid policy and catalog context, set gateway.agent_identity to null, {}, or {"agent_id": 42}. The helper returns verified=True with no failure and omits the agent_id comparison; the existing non-object-identity test expects that result. The profile calls for comparing identity when it is present. Please distinguish absent identity from malformed-present identity, return nonverified for the latter, and add a negative regression. This remains a scoped helper-contract concern: I have not demonstrated a bypass of the full schema-validated Claim flow. The focused 41-test suite passed.

[dinakarjs]

I prepared a signed adoption companion addressing the outstanding review finding: dinakarjs#6

Validation: unit suite 2547 passed/6 skipped; conformance+integration+confinement 114 passed/23 skipped. Ruff on src/tests, strict mypy and Bandit passed. All five malformed-identity parameter cases fail by assertion when just this fix is removed; valid/absent controls pass with the repair.

Please cherry-pick/adopt the companion and request independent re-review of the resulting head. I have contributed the follow-up and am not approving my own contribution.

[drk-ram]

Thanks @noah-ing! Distinguished absent gateway.agent_identity ("agent_identity" not in gateway, which skips the agent_id cross-check) from a present-but-malformed gateway.agent_identity (None, "not-an-object", {}, {"agent_id": 42}, {"agent_id": ""}), which now records a failure and returns verified=False, covered by regression assertions in tests/unit/test_embodied_action_evidence.py.

[drk-ram]

Thanks @dinakarjs and @noah-ing! Adopted @dinakarjs's signed companion commit 2411f8f (fix/review-806-20261025) directly as the branch head with authorship and signature preserved.

[noah-ing]

Reviewed exact head 2411f8f33811a9afdd63cfe80968527330d8c483. The supplied-but-malformed gateway.agent_identity cases now fail explicitly, while an absent identity remains optional; valid and mismatched identities behave as expected. I replayed nine cases against the signed ROS2 evidence fixture with receipt checking enabled. The focused tests passed (64/64), as did the full unit suite (2,533 passed, 20 skipped), Ruff, mypy, dependency and whitespace checks. This resolves my requested change, so I approve this scoped verifier fix. The normal hosted checks and merge gates still need to complete.

[carloshvp]

Reviewed exact head 2411f8f33811a9afdd63cfe80968527330d8c483 in an isolated checkout.

The updated source additionally rejects a supplied malformed Claim context and malformed present agent identity, while keeping the explicit no-Claim receipt-only mode and optional absent identity. The measurement, digest and container guards remain intact. Current receipt/Claim binding tests pass with valid controls; the reported receipt facts remain distinct from authorization and physical completion. No blocking finding in the updated paths.

Independent validation in a fresh repository-hash-locked Python 3.12.10 environment: 2,533 tests passed, 20 skipped; pip check, configured Ruff, mypy, Bandit and diff whitespace checks passed. Commit sign-offs are present. Hosted CI and applicable independent maintainer/security gates remain separate prerequisites to merge.

Reviewed with OpenAI Codex.