Reference implementation hashes inputs the spec says to reject

[aeoess]

compute_action_ref and compute_action_ref_v2 in plugins/agt_evidence_anchor/action_ref.py hash inputs that docs/spec/action-ref.md requires a verifier to reject before any digest comparison.

Context for why I have vectors to compare against: the APS SDK ships a cross-ecosystem correlation helper whose stated purpose is to reproduce this derivation byte for byte, with 13 published vectors at conformance/action-ref-v1/vectors.json. Over inputs both profiles accept, the digests agree exactly. The mismatch is in profile enforcement rather than in the hash.

The five timestamp cases. The Domain paragraph requires OUT_OF_PROFILE_DOMAIN and a stop before any digest comparison for malformed timestamp grammar. Both functions hash all five of these and return a normal-looking reference:

• 2026-05-24t10:30:00.000Z lowercase separator
• 2026-05-24T10:30:00.000z lowercase suffix
• 2026-05-24T10:30:00.000+00:00 numeric offset
• 2026-05-24T10:30:00Z second precision
• 2026-05-24T10:30:00.000000Z six fractional digits

Worth knowing how this gets reached. The default idiom in Python produces a form the spec rejects:

datetime.now(timezone.utc).isoformat()          2026-07-29T21:49:13.312610+00:00
isoformat(timespec="milliseconds")              2026-07-29T21:49:13.312+00:00
format_timestamp(datetime.now(timezone.utc))    2026-07-29T21:49:13.312Z

Only the third is conformant. The second still carries a numeric offset. So an implementer reaching for the language default rather than your format_timestamp helper produces two of the five rejected shapes at once, and the function hashes it.

Two other cases that may need clarification.

av-003 carries a scope of scope:звіт/📄, which is non-ASCII and includes an astral-plane character. The Domain paragraph excludes non-ASCII field values and surrogate-pair scope strings by name. The function hashed it and returned my expected digest.

av-007 carries an empty scope. The field table says scope is a free-form non-empty string, and the following line says to pass "" if not applicable. That reads as a wording conflict rather than a real divergence, but the function hashes it either way.

So the written profile and the copyable functions currently accept different input domains. Two fixes look clean from outside:

1. Enforce the profile inside both functions before hashing.
2. Mark the functions as derivation-only and ship a profile validator that the examples call first.

I have not tried to determine whether any caller validates first, since the documented consumers are external.

Happy to attach the full 13-vector result matrix if that is useful.

[aeoess]

Verified at 62930b5, independently rather than from the commit message.

Your validators on my run: action-ref-v1-domain-negative 7/7, action-ref-v2 3/3, both exit 0.

Then the original inputs from this issue through both functions directly, with hashlib.sha256 wrapped by a counter: all five timestamp variants reject with field=timestamp and zero sha256 constructions during the call, in compute_action_ref and compute_action_ref_v2 both. So the stop genuinely happens before any digest work, not just before comparison.

One precision on av-003: my published vector is non-ASCII in action_type and scope both, so with your validation order it rejects on action_type first. Your scope-isolated variant covers the scope case, so between the two sets both fields are exercised.

av-007 as published (empty scope) is accepted and returns cea68656343a06fad083af9a283329af96fcbc6c5fa183229823070fe635641b, matching my expected value, so cross-implementation parity holds on the fixed code, and the reworded scope row reads coherently now.

I also replayed every 4-field preimage in your fixtures through the patched functions: baseline 0001 and 0002, arv2-001 through 003 with both v1 and v2 digests. All match.

That resolves the report. Thanks for the fast turnaround and the credit; closing.

[giskard09]

Appreciate you re-deriving this independently rather than taking the commit message at face value — the counter-wrapped sha256 check confirming zero digest construction before the field rejection is a more rigorous bar than we tested against ourselves. Good catch on av-003 needing both fields split across the two vectors. Thanks for the fast turnaround note, and for closing it out cleanly.