Issues

• capture_witness_receipt and check_mirrors follow redirects off the host allowlist

  agentrust-io/trace-registry#173 · Filter by author drk-ram opened on Nov 3, 2026

• fix(aggregator,_checkpoint): validate TRACEAggregator inputs and enforce anchor_profile_violation in entry_leaf_digest

  agentrust-io/trace-registry#161 · Filter by author drk-ram opened on Oct 25, 2026

• fix(trace_verify/_mmr): enforce exact int types across MMR functions and harden InclusionProof/ConsistencyProof.from_dict

  agentrust-io/trace-registry#160 · Filter by author drk-ram opened on Oct 25, 2026

• fix(tools): enforce loads_unique across _registry_is_chained, is_already_anchored, load_published_entries, and verify_checkpoint_chain

  agentrust-io/trace-registry#159 · Filter by author drk-ram opened on Oct 25, 2026

• trace_verify.__main__: _check_url_allowed accepts loopback/private IP literals and _main_inclusion does not validate proof.leaf_index or entry.leaf_count types

  agentrust-io/trace-registry#158 · Filter by author drk-ram opened on Oct 25, 2026

• fix(trace_verify/_signature): enforce canonical base64url, reject private JWK members, and use strict JSON in load_producer_key

  agentrust-io/trace-registry#157 · Filter by author drk-ram opened on Oct 25, 2026

• fix(trace_verify/_witness): enforce lowercase hex on signature, registry_key, and witness_key and reject non-finite JSON constants

  agentrust-io/trace-registry#149 · Filter by author drk-ram opened on Oct 23, 2026

• fix(tools): enforce redirect allowlists and reject duplicate JSON keys in check_mirrors and capture_witness_receipt

  agentrust-io/trace-registry#150 · Filter by author drk-ram opened on Oct 23, 2026

• fix(trace_verify/_checkpoint): enforce canonical lowercase hex on key_id, root, and signature and reject unknown CheckpointRecord fields

  agentrust-io/trace-registry#148 · Filter by author drk-ram opened on Oct 23, 2026

• fix(aggregator): enforce strict Content-Length and producer validation in server and use loads_unique in CheckpointLog

  agentrust-io/trace-registry#151 · Filter by author drk-ram opened on Oct 23, 2026

• fix(trace_verify,tools): enforce registry-anchor-v1 surrogate/number rules, reject private JWKs, and harden MMR/JSON parsing

  agentrust-io/trace-registry#146 · Filter by author drk-ram opened on Oct 23, 2026

• Offering a neutral external witness for the registry's own history (your "Later" roadmap item)

  agentrust-io/trace-registry#53 · Filter by author StevenMih opened on Aug 31, 2026
  16