[drk-ram]

What this changes

Closes #617. Current source head: 76cacd81a18c40597e7088aaae3c05059071d754.

verify_bridge and verify_successor_artifact validate the trusted JWK with _pubkey_from_jwk, then require its kid to be a non-empty string at entry, before parsing the artifact. Malformed key identifiers therefore produce a key-specific IntentBridgeError, rather than an artifact mismatch. The later identifier comparison only checks equality.

verify_bridge validates the listed caller options (now, declaration, tool_call, pic_intent_digest, and pic_args_digest) before signature verification and denial handling. verify_successor_artifact validates trusted_observer and authorization_id at entry. _bind_successor_observation checks expected_successor_digest before the observation envelope. This does not claim to add entry validation for transcript.

evaluate_successor_observation passes a separate, recursively isolated JSON-compatible observation to the predicate through iterative _clone_observation, not copy.deepcopy. It preserves nested dictionaries, lists, and accepted tuple arrays and handles the reviewed 600-level nesting case without hitting Python's recursive-copy limit. Predicate mutation cannot change the caller's observation.

Wire schemas, published vectors, and integration documentation are unchanged. These are reference-library input validation and state-isolation fixes, not a wire-format change. Malformed caller options fail closed with the documented error family; concurrent mutation by another thread during digest computation is not covered by these regressions.

The latest review identified delayed kid validation and copy.deepcopy failing on an otherwise digestible deep observation. Both are corrected in the current source. This description removes the stale copy.deepcopy claim and historical measurements that did not describe the current head.

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Reference-library code fix; no normative specification or schema edit.

Spec section

None. Production changes are in src/agentrust_trace/intent_bridge.py and src/agentrust_trace/successor_observation.py.

Tests for a fix

The existing regression suite covers unusable authorizer/observer keys, malformed caller options before artifact/signature/denial errors, expected-digest validation, and predicate state isolation. The latest-review regressions are:

• tests/test_intent_bridge.py::test_verify_bridge_rejects_bad_trusted_authorizer_kid_at_entry and test_verify_successor_artifact_rejects_bad_trusted_observer_kid_at_entry, each parameterized over missing, empty, integer, and list identifiers.
• tests/test_intent_bridge.py::test_evaluate_successor_observation_clones_600_deep_observation.
• tests/test_successor_observation.py::test_predicate_receives_deep_copy_and_cannot_mutate_after_observation and test_predicate_cannot_mutate_nested_objects_inside_tuple_array.

Rerun on the current head with Python 3.11.9 and this checkout's src and conformance/src in PYTHONPATH:

python -m pytest tests\test_intent_bridge.py tests\test_successor_observation.py -q --tb=short -> 149 passed.

This rerun verifies the current tests; it is not a new claim of per-clause mutation coverage. Current-head hosted CI, Conformance CI, trust-record-verify, Review bar, and ClusterFuzzLite PR runs are successful. The changes-requested review and independent maintainer-approval requirement still need maintainer re-review.

Changelog entry

• Intent bridge and successor observation: validate trusted JWKs and non-empty key identifiers before untrusted artifacts, validate caller options before signature and denial outcomes, and isolate predicate observations with an iterative deep clone that preserves deeply nested accepted inputs (intent_bridge,successor_observation: validate caller options and trusted JWKs at entry and deep-copy observation before predicate #617, by @drk-ram).

Checklist

• DCO sign-off on all commits (git commit -s)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[lywinged]

From here on, pull requests do not edit CHANGELOG.md: put the entry you propose in the description under ## Changelog entry, and I write it under Unreleased on main at merge, crediting you. That is what #486 was asked on 12 October. The template and the 19 October note on #537 said otherwise, and five entries added at the same place in one file is why #537, #608 and #610 now conflict with main and with each other. For this one and #619, please drop the CHANGELOG.md hunk and move the text into the description; the conflicts on #537, #608 and #610 I take at merge. CONTRIBUTING and the template change to say so in a separate pull request, with a check that fails a pull request that touches the file.

[dinakarjs]

Reviewed exact head 25ddaf9. Caller configuration is validated before untrusted bridge input is consumed, signed timestamp values are retained, and successor predicates operate on detached observation state. Local focused intent-bridge/successor tests: 139 passed; Ruff and strict mypy (16 source files) passed. Hosted CI/conformance/review-bar checks are successful. No blocking finding.

[drk-ram]

Thanks @lywinged! Dropped the CHANGELOG.md hunk from #618, #619, #620, #621, #622, and #588 and moved each entry under ## Changelog entry in the PR description.

[rajnisht7]

The _pubkey_from_jwk move is good, but the trusted kid shape check is still not at entry.

In both verify_bridge and verify_successor_artifact, isinstance(trusted_kid, str) and bool(trusted_kid) still happens after the untrusted artifact has already been parsed. A cryptographically valid JWK with missing / empty / non-string kid can therefore surface artifact errors first.

#617 explicitly asks for the trusted JWK and its kid shape to be validated before any artifact inspection. The new tests cover unusable key material, but not this remaining ordering case, kindly hoist the non-empty-string check on trusted_*_jwk["kid"] right after _pubkey_from_jwk, and add a couple of regression tests that pair a valid public key (no/empty/bad kid) with a malformed artifact so the config error wins.

[lywinged]

Request changes. Reviewed at 25ddaf9 on c5d49a5.

What I checked rather than read:

• The three defects in #617 reproduce on main through the public functions and are gone here. A JWK carrying d under the wrong kid raises trusted_authorizer_jwk is unusable, now=-1 with a signed deny raises the now error, and a predicate writing to its argument leaves after alone.
• CI's commands, run on 3.12 and 3.11, pass, the full suite at 4817 passed and 48 skipped on both. The review bar finds all 31 test cases this adds failing on behaviour at the merge base.
• One at a time, I removed or moved back the 16 checks the diff touches, and the copy. Against the tests that reach the two modules, every mutant fails a test except the two that delete an or not trusted_kid clause.
• For the observations I tried, the predicate gets a separate copy of the observation, unchanged when the caller later edits after.

Two things.

1. rajnisht7's review of 25 October says the kid check still runs after the artifact is parsed, so a valid key with a missing, empty or non-string kid surfaces artifact errors first. It does: a correct key with "kid": 7, authorization_id="auth-7" and an artifact signed for auth-other gives AuthorizationMismatch from verify_successor_artifact, which the description rules out for a malformed JWK. Two more facts bear on moving it. Where it stands, or not trusted_kid cannot change a result for any str, because authorizer_key_id passed _nonempty_string on line 389 and observer_key_id on line 174; deleting both clauses leaves the whole suite green on 3.12. And moving the check changes behaviour that two existing tests pin: test_bridge_naming_another_authorizer_key_id_is_rejected wants key_to_jwk(key), which has no kid, to raise does not identify the trusted key, and the authorizer_key_id case of test_runtime_verifier_enforces_schema_scalar_constraints passes an empty kid and expects the artifact's error. I would move it, with a message that names the key:

    trusted_kid = trusted_authorizer_jwk.get("kid")
    if not isinstance(trusted_kid, str) or not trusted_kid:
        raise IntentBridgeError("trusted_authorizer_jwk kid must be a non-empty string")

right after _pubkey_from_jwk, the later comparison reduced to !=, the same for trusted_observer_jwk, and those two tests updated; the whole suite then passes on 3.12. It also wants the tests rajnisht7 asked for, one per function, in which a valid key with a missing, empty or non-string kid meets a malformed artifact and must raise the kid error: with only the two tests updated, moving the observer-side check back still passes every bridge test.

2. copy.deepcopy gives up before the digest does. With after["observation"] = json.loads('{"k":' * 600 + '{}' + '}' * 600) and its own digest, evaluate_successor_observation with a predicate reading one key returns established on main and raises RecursionError here, on 3.12 and 3.11. The fuzz harness, .clusterfuzzlite/fuzz_intent_bridge.py, states the property this breaks: evaluate_successor_observation documents SuccessorObservationError, and "any other exception is that evidence crashing it". A copy that can go as deep as the digest would keep main's answer; at the least, the RecursionError wants to become SuccessorObservationError. The copy in platform_measurement.py that the description points to sits inside a handler that turns any exception into appraiser_raised; this one has none, and tests/test_untrusted_input_stays_on_the_documented_error.py has no case for this function yet.

Things I would not hold the merge for:

• transcript is a parameter verify_bridge's entry block does not check: transcript="garbage" gives AuthorizationDenied with a signed deny and AuthorizationMismatch with a signed allow, as on main. #617 does not name it, though the description's promise covers it.

---

Generated by Claude Code

[drk-ram]

Thank you @rajnisht7 and @lywinged! Addressed both points in a12c467 (merged with origin/main at e9ab302):

1. Entry-point kid validation on trusted_authorizer_jwk and trusted_observer_jwk:
   • Hoisted trusted_kid = trusted_*_jwk.get("kid") and if not isinstance(trusted_kid, str) or not trusted_kid: raise IntentBridgeError("trusted_*_jwk kid must be a non-empty string") immediately after _pubkey_from_jwk(...) in both verify_bridge and verify_successor_artifact, and reduced the later comparison to !=.
   • Updated test_runtime_verifier_enforces_schema_scalar_constraints and test_bridge_naming_another_authorizer_key_id_is_rejected, and added test_verify_bridge_rejects_bad_trusted_authorizer_kid_at_entry and test_verify_successor_artifact_rejects_bad_trusted_observer_kid_at_entry pairing a valid public key (None / "" / 7 / ["kid"]) with malformed or mismatched artifacts.
2. Iterative observation cloning (_clone_observation) in evaluate_successor_observation:
   • Replaced copy.deepcopy(observation) with an iterative stack-based clone (_clone_observation) so a 600-level nested after["observation"] that passes digest_jcs evaluates cleanly to established without raising RecursionError while still detaching after["observation"] from predicate mutations (test_evaluate_successor_observation_clones_600_deep_observation).

[rajnisht7]

_clone_observation only walks dict and list. A tuple falls through to a plain assignment, so nested mutable objects stay shared
the project’s own JCS path accepts tuples as arrays (_refuse_whole_floats_out_of_range walks (list, tuple), and rfc8785.dumps treats them identically to lists). digest_jcs therefore succeeds on an observation that contains them, binding and evaluation succeed, and a predicate can still mutate the caller’s original:

obs = {"tuple_array": ({"secret": "original"},)}
after = {"observation": obs, "observer": "observer-1", "observed_at": 160}
# digest_jcs(after) succeeds; evaluate_successor_observation(...) returns established
# after["observation"]["tuple_array"][0]["secret"] is now "MUTATED"

copy.deepcopy isolates this correctly but the iterative clone does not. existing tests only cover pure dict/list trees, so they stay green, kindly treat tuple the same as list in the clone (or otherwise detach it) and add a regression that exercises a tuple containing a mutable dict/list.

[drk-ram]

@rajnisht7 Rebased onto origin/main (b938790) in 76cacd8, updated _clone_observation in src/agentrust_trace/successor_observation.py to iteratively clone tuple containers and reconstruct nested tuples bottom-up so mutable dict/list elements inside tuples are detached, and added test_predicate_cannot_mutate_nested_objects_inside_tuple_array in tests/test_successor_observation.py.

[dinakarjs]

Re-reviewed current head 76cacd8. This supersedes the limited caller-configuration/isolation assessment in my older 25ddaf9 review: subsequent review correctly found kid-validation ordering, deep-copy depth and mutable objects inside tuples that it had not established. The current source now checks trusted kid shape at entry and iteratively detaches dict/list/tuple observations.

In this head's fresh hash-locked Python 3.12.14 environment, tests/test_intent_bridge.py plus tests/test_successor_observation.py pass 149 cases normally and under -O, including the deep and tuple controls. Changed-file Ruff and strict mypy for the two changed modules pass. No remaining blocker found in these selected paths. I did not rerun the full TRACE suite for this review; normal current-head CI, other reviewers' disposition and maintainer policy remain prerequisites. No withdrawal/status-service or production acceptance claim. Prepared with OpenAI Codex.

[drk-ram]

The current head 76cacd8 validates authorizer and observer kid at entry and uses iterative _clone_observation instead of copy.deepcopy. The 600-level observation and both malformed-kid regressions are present; the bridge and successor suites pass all 149 tests. I corrected the stale description to match the current implementation. Please re-review the remaining changes request.