[dinakarjs]

Adds an informative answer to evidence-resolution question 4 in §11.1 of the composite-component appraisal RFC, plus ER01 tests against the existing canonical_digest helper. Refs #441; does not close it. ER02 to ER09 and selection of a resolver profile remain planned.

ER01 checks three equivalent encodings against pinned canonical bytes and a changed nested member against its distinct digest. Two further controls pin UTF-16 key ordering (U+E000 versus U+1F600) and exponent spelling (1e-7). These catch sorted JSON even after whole-valued floats are normalized to integers. The proposal names processing actors, clarifies the future change to §9's current non-goal, and describes the executed cases accurately. No runtime, schema or normative contract changes.

Validation

Historical validation at 6690f0c8e5a2828cfc7e8326bf2ec60fe7880d7b:

• Focused ER01: 5 passed.
• Replacing canonical_digest in memory with sorted, compact JSON plus recursive integral-float normalization: the original 3 cases pass and both new cases fail their pinned-digest assertions.
• Ruff passes for the changed test.
• Markdown rendering of §11.1 retains all 9 matrix rows; revised wording and house-style characters checked.
• Full-suite, workflow-style docs build and hosted checks have not been rerun on this new head.

Historical validation at parent 624b939: 4,220 passed, 48 skipped; Ruff, reference-library mypy, house-style and assembled docs checks passed. Those results and approvals do not constitute validation or approval of this new commit.

Review and references

The latest reviewer identified a normalized sorted-JSON substitute that survived the original tests. Both new cases detect it. The wording suggestions were also incorporated. Primary literature and its scope remain in §11.1; prior art does not validate unimplemented evidence resolution.

All three commits carry DCO sign-off. Prepared with OpenAI Codex. The PR was already ready for review when refreshed; it remains ready. Independent review of this follow-up and broader #441 profile decisions remain open.

CI refresh at 6690f0c: ordinary tests, lint, type checking, Conformance CI, Docs, Review bar, and CodeQL passed. The portability step fails in the existing test_the_javascript_side_agrees because Python decodes Node's UTF-8 output with the ASCII locale; the failed portability run reports 4,788 passed, 50 skipped, and that one failure. The same bug is present on main. Separate repair: #624. That historical failure is superseded by the current-head results below.

Current-head status — 28 October 2026

The maintainer merged main 4ec0320 into this branch at 2fe3e9a, incorporating #624. Verified the current-head GitHub check runs: all five reported test jobs, combined documentation, conformance documentation, CodeQL/analysis, Review bar report and Changelog guard succeed. The remaining failing workflow is Require maintainer approval; the separate enable job is skipped. No new local full-suite execution is claimed in this status update. The update/CI action is complete; independent current-head approval and broader #441 profile decisions remain separate. Prepared with OpenAI Codex.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

@imran-siddique the exact-head technical workflows have succeeded; this remains an informative draft with the proposed acceptance cases unexecuted. Please review the bounded scope/placement and the explicit representation decisions in the proposal, or name the maintainer who should decide them. I am not treating a green technical run as approval of the design or permission to implement a new normative contract.

[imran-siddique]

@dinakarjs right repo and right folder, and the code references hold: canonical_digest is in prototype/verifier_token.py and appraise_collateral does assume an authenticated packet.

Two changes. Fold this into composite-component-appraisal.md as the answer to open question 4 in §11, since #441 came from that question, instead of a sibling file. And add ER01 as a test against canonical_digest, so the section carries one executed row instead of nine planned ones.

[dinakarjs]

Addressed both requested revisions at 624b9396f12d85eec69daaa5d9ef09a65b1444d2: the proposal is folded into composite-component-appraisal.md §11.1 as the bounded answer to question 4, and the sibling page is removed. ER01 is now executed against canonical_digest with pinned canonical preimages, three equivalent encodings and a changed-member twin. Full reference suite: 4,220 passed / 48 skipped; Ruff, mypy, house style and assembled docs build pass. Raw-text hashing and constant-digest substitutions each fail ER01 behaviorally. The PR description records commands, evidence limits and literature. Please review this head; ER02–ER09 and resolver/profile decisions remain open. No production or normative change; no independent approval claimed. Prepared with Codex.

[imran-siddique]

At 624b939 the sibling page is gone and §11.1 answers question 4 in place. ER01 passes, 3 of 3. Four mutants of canonical_digest all fail it: constant output, compact json.dumps, dropping nested members, and sort_keys JSON without RFC 8785. The sort_keys one only fails on the equivalent-numbers case, which is the reason that case is there. I also checked R5 against arXiv 2609.39717 v2. Approving. Please mark it ready for review.

[lywinged]

Approved. Reviewed at 624b939 on base a7f0858, 24 first-parent commits behind main.

The placement is the one the Project Lead asked for, and the text claims what it executes and nothing more: question 4's added sentence says only ER01 runs, §9's "does not resolve or re-appraise evidence" stays true today, and the sentences the proposal attributes to the code hold. appraise_collateral in prototype/snp_collateral.py opens with "Appraise an already-authenticated packet's platform collateral", canonical_digest is digest(rfc8785.dumps(value)) with digest prefixing sha256:, and the packets that "can legitimately fall below the selected vendor floor" are the two tests/test_snp_collateral.py already pins below the SB-3016 floor. The three issues 11.1 points at say what it says they say.

What I checked rather than read:

• ER01: 3 passed. The four mutants named in the approval, run here: constant output, compact json.dumps and dropped nested members each fail all three cases; sort_keys without RFC 8785 fails only equivalent-numbers, as stated.
• All three encodings are written in non-canonical key order, which by itself keeps each raw hash apart from the pinned digest; the second adds whitespace and the third number spelling. So the raw-text assertion holds in every case, as a property of how the fixtures are written.
• The table has nine rows, and the docs build assembled the way docs.yml assembles it renders §11.1 with all nine.
• CI's steps with the pinned install on 3.12: ruff, the dash check and mypy clean; the suite with and without --cov, 4220 passed and 48 skipped on the head, the number the description gives; the head merged onto today's main here, 4683 passed and 48 skipped, the 4680 of main plus ER01's three.
• No dashes in the added lines; both commits carry a sign-off; the sibling file from the first commit is gone from the net diff, and mkdocs.yml is untouched.

One suggestion, not a condition. ER01 pins key order, whitespace and whole-valued floats, and a canonicalizer that is not RFC 8785 survives all three: json.dumps(sort_keys=True, separators=(",", ":"), ensure_ascii=False) over the object with its whole-valued floats first turned into integers passes the test as it stands. It parts from JCS where the delegation corpus's vector 24 already looks, a key outside the Basic Multilingual Plane sorted by UTF-16 code unit rather than by code point, and on a float such as 1e-7, which JCS writes as 1e-7 and Python as 1e-07. The key pair has to be vector 24's shape, a BMP key above the surrogate range such as U+E000 beside U+1F600; an ASCII or CJK key beside the astral one sorts the same way under both. One such pair in the synthetic object, or one such float, with the pinned bytes updated, would make "RFC 8785" in obligation 2 the thing the test pins rather than the thing it names. I would not hold the merge for it.

Two smaller things, neither a condition. The six "Proposed processing obligations" are bare imperatives, and this document's preamble says "A proposal that writes itself in the imperative is a specification nobody agreed to"; the resolver retains and the relying party checks would keep the section inside the rule it sits under, and a clause saying §9's first bullet changes if the slice is adopted would keep the two sections from stating both. And the ER01 row names whitespace and member order, while the third case, number spelling, is the one that separates sort_keys from RFC 8785; the row could say so.

On the literature: R1's sections 8 and 10 are Conceptual Messages, with 8.5 Appraisal Policies, and Freshness, so the citation points where it says for two of the three things it names; roles are not what either section is titled for. R5 was checked in the approval above. R2 to R4 I did not read on this pass.

[lywinged]

Approved again, at 6690f0c on a7f0858. My approval of 624b939 went stale with this push, which takes up what that review suggested.

What I checked rather than read:

• The two new cases are the ones the suggestion asked for: the key pair U+E000 beside U+1F600, and 1e-7. With canonical_digest replaced by json.dumps(sort_keys=True, separators=(",", ":"), ensure_ascii=False) over the object with its whole-valued floats turned into integers, both now fail where the three earlier cases pass, as the description reports. The four mutants named in the other approval of 624b939 still fail; constant output and compact json.dumps now fail all five cases.
• The six obligations now name who does each, the section says §9's first non-goal would change if the slice is adopted, the ER01 row names number spelling, and R1 names conceptual messages, appraisal policies and freshness, which are what sections 8 and 10 are about.
• CI's commands, run here with the pinned install on 3.11 and on 3.12, the counts the same on both: ruff, the dash check and mypy clean; 4222 passed and 48 skipped; the experiments lane 116 passed and 4 skipped; under the portability step, 4221 passed and 49 skipped, the conformance suite 843 passed, 2 skipped and 5 xpassed, and the PYTHONOPTIMIZE=2 review bar tests 52 passed.
• CI at 6690f0c failed in the portability step for a reason this pull request did not cause: as the description says, the same bug was on main until #624, which is on main now, and main's CI passes at dcca4e0; an update from main brings the fix in. Node 22 here does not reproduce it. With Node's spec reporter forced, the default from Node 23 on, and the step's LC_ALL=C PYTHONUTF8=0, the head fails in test_the_javascript_side_agrees with UnicodeDecodeError from the ASCII codec, the cause the description gives, and the head merged onto main passes.
• main is 41 commits ahead of a7f0858 and has touched neither file. Merged onto main at 4ec0320, cleanly, on 3.12: 5154 passed and 98 skipped, and under the portability step 5153 passed and 99 skipped.
• No dashes in the added lines; git diff --check against the base silent.

---

Generated by Claude Code