Adversarial verification pass: fix §5.8 throw paths and cross-impl parity gaps

Three adversarial refuters (JCS byte-identity, port fidelity, degradation/
hostile-daemon) plus an addenda-test porter ran against both SDKs.
Confirmed findings, all fixed with pinned regressions:

- TS DaemonClient: new URL() on a garbage endpoint escaped the §5.8
  catch and poisoned the connecting state; URL parsing now degrades.
- TS/Python anchor sets: null/non-object entries, non-string endpoints,
  and unparseable endpoint URLs now warn-and-skip instead of throwing
  (including the emitInProcess submission-queue throw a bad anchor could
  reach); Python now matches TS in skipping any PRESENT anchor_type
  other than 'atrib-log', including non-strings and null.
- Python mirror reader: a single invalid-UTF-8 byte anywhere in the file
  raised UnicodeDecodeError through both verbs; lines now decode
  individually and malformed ones skip per §5.9.5.
- Python normalize_server_url rebuilt for WHATWG parity: IPv6 brackets,
  special-scheme slash collapsing, empty-host fallback, edge C0/space
  stripping, opaque-host case preservation, scheme-only-colon URLs.
- is_valid_event_type_uri length now counts UTF-16 code units like the
  JS reference; timestamp validation accepts integral floats like
  Number.isInteger over identical wire bytes.
- evidence.ts dedup key had a NUL byte where a space belonged
  (write-tool artifact), diverging from Python; fixed and repo-scanned.
- Receipt parsing tightened: all-wrong-typed receipts read as absent,
  array record/receipt values dropped; a daemon emit result without a
  record_hash now falls through to in-process signing instead of
  reporting silent all-null success.
- Documented, deliberate boundary (not routed around): non-I-JSON
  content (ints ≥ 2^53, lone surrogates) canonicalizes lossily in JS but
  raises in Python; rejection contract pinned in test_port_parity.py and
  documented in python/README.md.

Suites: TS 117 passed + 1 skip; Python 251 passed + 6 skips incl. the
62-case cross-impl determinism judge; mypy strict clean; doc-sync green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ZsFiTVkgLp3BoBXQiJ3ba

Author: claude

packages/sdk/src/attribution.ts

@@ -65,16 +65,22 @@ export function parseAttributionReceiptBlock(meta: unknown): AttributionReceiptB
   const out: AttributionReceiptBlock = {}
   if (typeof block['token'] === 'string') out.token = block['token']
   const rawReceipt = block['receipt']
-  if (typeof rawReceipt === 'object' && rawReceipt !== null) {
+  if (typeof rawReceipt === 'object' && rawReceipt !== null && !Array.isArray(rawReceipt)) {
     const receipt: AttributionReceipt = {}
+    let kept = 0
     for (const field of RECEIPT_STRING_FIELDS) {
       const value = (rawReceipt as Record<string, unknown>)[field]
-      if (typeof value === 'string') receipt[field] = value
+      if (typeof value === 'string') {
+        receipt[field] = value
+        kept += 1
+      }
     }
-    out.receipt = receipt
+    // A receipt where every field was wrong-typed conveys nothing; treat
+    // it as absent rather than surfacing an empty object.
+    if (kept > 0) out.receipt = receipt
   }
   const rawRecord = block['record']
-  if (typeof rawRecord === 'object' && rawRecord !== null) {
+  if (typeof rawRecord === 'object' && rawRecord !== null && !Array.isArray(rawRecord)) {
     out.record = rawRecord as AtribRecord
   }
   return out.token !== undefined || out.receipt !== undefined || out.record !== undefined

packages/sdk/src/client.ts

@@ -110,18 +110,22 @@ export function createAtribClient(config: AtribClientConfig = {}): AtribClient {
 
     if (daemon) {
       const outcome = await daemon.callTool('emit', args)
-      if (outcome.ok && typeof outcome.value === 'object' && outcome.value !== null) {
-        const result = attestResultFromEmitOutput(
-          outcome.value as EmitOutputLike,
-          'daemon',
-          warnings,
-        )
-        return outcome.attribution !== undefined
-          ? { ...result, attribution_receipt: outcome.attribution }
+      const attribution = outcome.ok ? outcome.attribution : undefined
+      const emitOutput =
+        outcome.ok && typeof outcome.value === 'object' && outcome.value !== null
+          ? (outcome.value as EmitOutputLike)
+          : null
+      // A structurally-garbage daemon result (no record_hash string) is a
+      // daemon FAILURE, not a silent all-null success — fall through so
+      // the in-process path can still sign.
+      if (emitOutput !== null && typeof emitOutput.record_hash === 'string') {
+        const result = attestResultFromEmitOutput(emitOutput, 'daemon', warnings)
+        return attribution !== undefined
+          ? { ...result, attribution_receipt: attribution }
           : result
       }
       const reason = outcome.ok
-        ? 'daemon returned a non-object emit result'
+        ? 'daemon returned an emit result without a record_hash'
         : outcome.reason
       warnings.push(`atrib: daemon attest failed: ${reason}`)
       if (daemonMode === 'require') {

packages/sdk/src/config.ts

@@ -122,14 +122,35 @@ export function resolveAnchorSet(anchors: AnchorSpec[] | undefined): ResolvedAnc
   }
   const atribLogEndpoints: string[] = []
   for (const spec of anchors) {
-    const endpoint = typeof spec === 'string' ? spec : spec.endpoint
-    const anchorType = typeof spec === 'string' ? undefined : spec.anchor_type
+    // Hostile/malformed entries warn-and-skip, never throw (§5.8): the
+    // documented anchor posture is "warning, not an error".
+    let endpoint: unknown
+    let anchorType: unknown
+    if (typeof spec === 'string') {
+      endpoint = spec
+    } else if (typeof spec === 'object' && spec !== null) {
+      endpoint = (spec as { endpoint?: unknown }).endpoint
+      anchorType = (spec as { anchor_type?: unknown }).anchor_type
+    } else {
+      warnings.push(`atrib: anchor entry ${String(spec)} is not a string or object; skipping`)
+      continue
+    }
+    if (typeof endpoint !== 'string') {
+      warnings.push('atrib: anchor entry without a string endpoint; skipping')
+      continue
+    }
     if (anchorType !== undefined && anchorType !== 'atrib-log') {
       warnings.push(
-        `atrib: anchor_type '${anchorType}' (${endpoint}) is not supported yet (upgrade-path step 1); skipping this anchor`,
+        `atrib: anchor_type '${String(anchorType)}' (${endpoint}) is not supported yet (upgrade-path step 1); skipping this anchor`,
       )
       continue
     }
+    try {
+      new URL(endpoint)
+    } catch {
+      warnings.push(`atrib: anchor endpoint '${endpoint}' is not a valid URL; skipping`)
+      continue
+    }
     atribLogEndpoints.push(endpoint)
   }
   if (atribLogEndpoints.length > 1) {

packages/sdk/src/daemon.ts

@@ -134,24 +134,28 @@ export class DaemonClient {
       return null
     }
     this.connecting = (async () => {
-      // The SDK's concrete transport declares `sessionId: string | undefined`
-      // while the Transport interface under exactOptionalPropertyTypes wants
-      // an optional property; the runtime shapes are identical.
-      const transport = new StreamableHTTPClientTransport(
-        new URL(this.endpoint),
-      ) as unknown as Transport
-      const client = new Client(SDK_CLIENT_INFO)
+      let client: Client | null = null
       try {
+        // URL parsing stays INSIDE the try: a garbage endpoint is an
+        // operational failure that must degrade (§5.8), never throw.
+        const url = new URL(this.endpoint)
+        // The SDK's concrete transport declares `sessionId: string | undefined`
+        // while the Transport interface under exactOptionalPropertyTypes wants
+        // an optional property; the runtime shapes are identical.
+        const transport = new StreamableHTTPClientTransport(url) as unknown as Transport
+        client = new Client(SDK_CLIENT_INFO)
         await withTimeout(client.connect(transport), this.connectTimeoutMs, 'daemon connect')
         this.client = client
         this.lastFailureAt = 0
         return client
       } catch (error) {
         this.lastFailureAt = Date.now()
-        try {
-          await client.close()
-        } catch {
-          // Ignore close failures on a connection that never established.
+        if (client) {
+          try {
+            await client.close()
+          } catch {
+            // Ignore close failures on a connection that never established.
+          }
         }
         const reason = error instanceof Error ? error.message : String(error)
         console.warn(`atrib: daemon connect failed (${this.endpoint}): ${reason}`)

packages/sdk/src/evidence.ts

@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Post-spawn addenda surfaces of the consolidated SDK:
+ *
+ * - `dev.atrib/attribution` receipt parsing (P049 draft): lenient extraction
+ *   from a tool result's `_meta`; anything malformed yields null, wrong-typed
+ *   fields are dropped, never a throw.
+ * - Anchor-set resolution (P043 headroom): today's single-atrib-log posture
+ *   with warn-never-error handling of unsupported anchor types and fan-out.
+ * - Evidence envelope helpers (P042 draft): dedup key `(profile, payload.hash)`
+ *   and the four-value tier ladder.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  ATTRIBUTION_EXTENSION_KEY,
+  evidenceEnvelopeKey,
+  evidenceTierRank,
+  parseAttributionReceiptBlock,
+  resolveAnchorSet,
+  type AtribRecord,
+  type EvidenceEnvelope,
+} from '../src/index.js'
+
+const RECORD: AtribRecord = {
+  spec_version: 'atrib/1.0',
+  content_id: `sha256:${'ab'.repeat(32)}`,
+  creator_key: '0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc',
+  chain_root: `sha256:${'12'.repeat(32)}`,
+  event_type: 'https://atrib.dev/v1/types/observation',
+  context_id: 'a'.repeat(32),
+  timestamp: 1700000000000,
+  signature: 'sig',
+}
+
+const FULL_RECEIPT = {
+  record_hash: `sha256:${'cd'.repeat(32)}`,
+  creator_key: '0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc',
+  context_id: 'a'.repeat(32),
+  event_type: 'https://atrib.dev/v1/types/observation',
+  chain_root: `sha256:${'12'.repeat(32)}`,
+  log_submission: 'queued',
+}
+
+function metaWith(block: unknown): Record<string, unknown> {
+  return { [ATTRIBUTION_EXTENSION_KEY]: block }
+}
+
+describe('parseAttributionReceiptBlock (P049 receipts)', () => {
+  it('exposes the extension key constant', () => {
+    expect(ATTRIBUTION_EXTENSION_KEY).toBe('dev.atrib/attribution')
+  })
+
+  it('parses a valid full block: token + receipt + record', () => {
+    const block = parseAttributionReceiptBlock(
+      metaWith({ token: 'abc.def', receipt: FULL_RECEIPT, record: RECORD }),
+    )
+    expect(block).not.toBeNull()
+    expect(block?.token).toBe('abc.def')
+    expect(block?.receipt).toEqual(FULL_RECEIPT)
+    expect(block?.record).toEqual(RECORD)
+  })
+
+  it('parses a token-only block', () => {
+    const block = parseAttributionReceiptBlock(metaWith({ token: 'abc.def' }))
+    expect(block).toEqual({ token: 'abc.def' })
+    expect(block?.receipt).toBeUndefined()
+    expect(block?.record).toBeUndefined()
+  })
+
+  it('parses a receipt-only block', () => {
+    const block = parseAttributionReceiptBlock(metaWith({ receipt: FULL_RECEIPT }))
+    expect(block).toEqual({ receipt: FULL_RECEIPT })
+    expect(block?.token).toBeUndefined()
+    expect(block?.record).toBeUndefined()
+  })
+
+  it('ignores unknown extra fields at both block and receipt level', () => {
+    const block = parseAttributionReceiptBlock(
+      metaWith({
+        token: 'abc.def',
+        receipt: { ...FULL_RECEIPT, surprise: 'yes', tier: 3 },
+        future_field: { nested: true },
+      }),
+    )
+    expect(block).not.toBeNull()
+    expect(block?.token).toBe('abc.def')
+    // Only the known string fields survive; unknown keys never leak through.
+    expect(block?.receipt).toEqual(FULL_RECEIPT)
+    expect(block && 'future_field' in block).toBe(false)
+  })
+
+  it('drops wrong-typed fields instead of throwing', () => {
+    const block = parseAttributionReceiptBlock(
+      metaWith({
+        token: 42,
+        receipt: {
+          record_hash: 42,
+          creator_key: null,
+          context_id: ['a'.repeat(32)],
+          event_type: { uri: 'x' },
+          chain_root: true,
+          log_submission: 'queued',
+        },
+      }),
+    )
+    expect(block).not.toBeNull()
+    // token was a number → absent
+    expect(block?.token).toBeUndefined()
+    // receipt object survives with only the correctly-typed field
+    expect(block?.receipt).toEqual({ log_submission: 'queued' })
+    expect(block?.receipt?.record_hash).toBeUndefined()
+  })
+
+  it('accepts unknown future log_submission statuses as strings', () => {
+    const block = parseAttributionReceiptBlock(
+      metaWith({ receipt: { log_submission: 'replicated' } }),
+    )
+    expect(block?.receipt?.log_submission).toBe('replicated')
+  })
+
+  it('returns null when the dev.atrib/attribution key is missing', () => {
+    expect(parseAttributionReceiptBlock({})).toBeNull()
+    expect(parseAttributionReceiptBlock({ 'other.ext/key': { token: 'x' } })).toBeNull()
+  })
+
+  it('returns null for non-object meta values', () => {
+    expect(parseAttributionReceiptBlock(null)).toBeNull()
+    expect(parseAttributionReceiptBlock(undefined)).toBeNull()
+    expect(parseAttributionReceiptBlock(42)).toBeNull()
+    expect(parseAttributionReceiptBlock('x')).toBeNull()
+  })
+
+  it('returns null for a non-object or empty extension block', () => {
+    expect(parseAttributionReceiptBlock(metaWith('token'))).toBeNull()
+    expect(parseAttributionReceiptBlock(metaWith(null))).toBeNull()
+    // Object with none of token/receipt/record recognized → null
+    expect(parseAttributionReceiptBlock(metaWith({}))).toBeNull()
+    expect(parseAttributionReceiptBlock(metaWith({ token: 42, record: 'x' }))).toBeNull()
+  })
+})
+
+describe('resolveAnchorSet (P043 anchor headroom)', () => {
+  const LOG_A = 'https://log.atrib.dev/v1/entries'
+  const LOG_B = 'https://log-b.example.dev/v1/entries'
+  const REKOR = 'https://rekor.example.dev'
+
+  it('resolves undefined to no endpoint and no warnings', () => {
+    expect(resolveAnchorSet(undefined)).toEqual({
+      primaryLogEndpoint: undefined,
+      warnings: [],
+    })
+  })
+
+  it('resolves an empty set to no endpoint and no warnings', () => {
+    expect(resolveAnchorSet([])).toEqual({
+      primaryLogEndpoint: undefined,
+      warnings: [],
+    })
+  })
+
+  it('accepts a single bare-string anchor as an atrib-log endpoint', () => {
+    expect(resolveAnchorSet([LOG_A])).toEqual({
+      primaryLogEndpoint: LOG_A,
+      warnings: [],
+    })
+  })
+
+  it('accepts the object form without anchor_type', () => {
+    expect(resolveAnchorSet([{ endpoint: LOG_A }])).toEqual({
+      primaryLogEndpoint: LOG_A,
+      warnings: [],
+    })
+  })
+
+  it("accepts an explicit anchor_type of 'atrib-log'", () => {
+    expect(resolveAnchorSet([{ endpoint: LOG_A, anchor_type: 'atrib-log' }])).toEqual({
+      primaryLogEndpoint: LOG_A,
+      warnings: [],
+    })
+  })
+
+  it('skips unsupported anchor types with a warning naming the type', () => {
+    const resolved = resolveAnchorSet([{ endpoint: REKOR, anchor_type: 'rekor' }])
+    expect(resolved.primaryLogEndpoint).toBeUndefined()
+    expect(resolved.warnings).toHaveLength(1)
+    expect(resolved.warnings[0]).toContain("'rekor'")
+    expect(resolved.warnings[0]).toContain(REKOR)
+  })
+
+  it('picks the first of two atrib-log anchors and warns about fan-out', () => {
+    const resolved = resolveAnchorSet([LOG_A, { endpoint: LOG_B }])
+    expect(resolved.primaryLogEndpoint).toBe(LOG_A)
+    expect(resolved.warnings).toHaveLength(1)
+    expect(resolved.warnings[0]).toContain('multi-anchor fan-out')
+  })
+
+  it('chooses the atrib-log endpoint when it follows a skipped anchor', () => {
+    const resolved = resolveAnchorSet([{ endpoint: REKOR, anchor_type: 'rekor' }, LOG_A])
+    expect(resolved.primaryLogEndpoint).toBe(LOG_A)
+    // One skip warning; no fan-out warning for a single usable anchor.
+    expect(resolved.warnings).toHaveLength(1)
+    expect(resolved.warnings[0]).toContain("'rekor'")
+  })
+})
+
+describe('evidence envelope helpers (P042 draft)', () => {
+  const PAYLOAD_HASH = `sha256:${'ef'.repeat(32)}`
+
+  function envelope(tier: EvidenceEnvelope['tier']): EvidenceEnvelope {
+    return {
+      envelope: 1,
+      profile: 'https://atrib.dev/v1/evidence/oauth2',
+      profile_version: '1.0.0',
+      tier,
+      payload: { hash: PAYLOAD_HASH },
+    }
+  }
+
+  it('derives the dedup key from profile and payload hash', () => {
+    expect(evidenceEnvelopeKey(envelope('verified'))).toBe(
+      `https://atrib.dev/v1/evidence/oauth2 ${PAYLOAD_HASH}`,
+    )
+  })
+
+  it('keys are tier-independent (same profile + hash collide)', () => {
+    expect(evidenceEnvelopeKey(envelope('declared'))).toBe(
+      evidenceEnvelopeKey(envelope('verified')),
+    )
+  })
+
+  it('ranks the tier ladder declared < shape < attested < verified', () => {
+    expect(evidenceTierRank('declared')).toBe(0)
+    expect(evidenceTierRank('shape')).toBe(1)
+    expect(evidenceTierRank('attested')).toBe(2)
+    expect(evidenceTierRank('verified')).toBe(3)
+    expect(evidenceTierRank('declared')).toBeLessThan(evidenceTierRank('shape'))
+    expect(evidenceTierRank('shape')).toBeLessThan(evidenceTierRank('attested'))
+    expect(evidenceTierRank('attested')).toBeLessThan(evidenceTierRank('verified'))
+  })
+})