Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

conformance(inclusion): enforce registry-anchor-v1 surrogate/key/cycle rules and validate leaf_index/entry fields

Open
  • Is something wrong?
#625 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@drk-ram is already working on this.

Since Oct 25, 2026.

  • #630 by @drk-ram — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
python
Domain
backend, testing

Research direction

Start with conformance/src/trace_tests/inclusion.py, especially _outside_profile, parse_proof, and parse_entry; read the registry-anchor-v1 rules referenced in the issue and inspect their existing tests. Add or update tests for surrogate strings, dictionary keys and cycles, proof index and count bounds, and entry fields. Done means malformed inputs raise InclusionError and the conformance tests pass; an open linked pull request is already addressing this issue.

Written by the indexing model from the issue text.

Description

needs-review:MEDIUM
Summary

Three verification-boundary gaps exist in conformance/src/trace_tests/inclusion.py:

  1. Unpaired UTF-16 surrogates, non-string dict keys, and circular references in _outside_profile (conformance/src/trace_tests/inclusion.py lines 42-64):

    • _outside_profile(value) skips all strings (if isinstance(v, bool) or v is None or isinstance(v, str): continue), never inspects dictionary keys (stack.extend(v.values())), and has no cycle detection.
    • As a result, canonical_claim_bytes accepts unpaired UTF-16 surrogates (U+D800..U+DFFF) in string values and object keys (violating registry-anchor-v1 section 1), fails to reject non-string dictionary keys before json.dumps, and hangs in an infinite loop on cyclic dicts/lists.

  2. Missing integer and range validation on leaf_index and leaf_count in parse_proof (conformance/src/trace_tests/inclusion.py lines 134-168):

    • parse_proof checks type(leaf_count) is not int when leaf_count is present, but does not require 1 <= leaf_count <= 2**53 - 1, and does not validate receipt["leaf_index"] (type(leaf_index) is not int or leaf_index < 0, or leaf_index >= leaf_count when leaf_count is present).
    • Consequently, malformed receipts carrying leaf_index=True, leaf_index="0", leaf_index=-1, or leaf_count=0 pass parse_proof / parse_receipt without raising InclusionError, causing TR-ANC-002 to misreport a structurally malformed receipt as a Merkle root mismatch.

  3. Whitespace-only / control-character strings accepted in parse_entry (conformance/src/trace_tests/inclusion.py lines 195-230):

    • parse_entry checks if not isinstance(entry[key], str) or not entry[key], which accepts whitespace-only or newline/control-character strings in producer and batch_id, and does not bound leaf_count <= 2**53 - 1 (type(leaf_count) is int).
Proposed Fix
  • Update _outside_profile in conformance/src/trace_tests/inclusion.py to reject unpaired UTF-16 surrogates (0xD800 <= ord(ch) <= 0xDFFF) in string values and dict keys, reject non-string dict keys, and detect circular references on the active traversal path.
  • Validate type(leaf_index) is int and 0 <= leaf_index <= _SAFE_INT and (when present) 1 <= leaf_count <= _SAFE_INT and leaf_index < leaf_count in parse_proof.
  • Reject whitespace/control characters in producer and batch_id and enforce type(leaf_count) is int and 1 <= leaf_count <= _SAFE_INT in parse_entry.
Dominant language
Python
Stars
37
Forks
33
Avg merge
1d 7h
Merged PRs (30d)
111

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/trace-spec

All issues in agentrust-io/trace-spec

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.