[drk-ram]

What this changes

Closes #647.

Hardens _validate_context and verify_delegation_chain in src/agentrust_trace/delegation.py:

• Rejects RFC 7517/7518 private or symmetric key parameters (d, p, q, dp, dq, qi, oth, k) on entries in context.trusted_root_keys without echoing secret values.
• Bounds context.max_depth to JCS_SAFE_INTEGER (9007199254740991) and rejects duplicate entries in context.data_class_lattice.
• Requires non-empty issuer and holder strings on each credential in context.credentials, bounds not_before and not_after to [0, JCS_SAFE_INTEGER], and requires not_before <= not_after.
• Initializes visited = {id(current)} in verify_delegation_chain so a cycle returning to the leaf stops at the first return.

Validation commands and results:

• PYTHONPATH=src python -m pytest tests/test_delegation_module.py tests/test_delegation_vectors.py -q -> passed (143 passed)
• python -m ruff check src/agentrust_trace/delegation.py tests/test_delegation_module.py -> passed (All checks passed!)
• PYTHONPATH=src python -m mypy src/agentrust_trace -> passed (Success: no issues found in 17 source files)
• python tools/check_dashes.py -> passed (no dashes outside examples/, spec/trace-v0.1.md)
• PYTHONPATH=src python tools/review_bar.py --base origin/main --head HEAD -> passed (18 changed test cases fail on behaviour at origin/main)

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

src/agentrust_trace/delegation.py (informative A2A delegation chain profile; no normative change to spec/trace-v0.2.md)

Tests for a fix

• _JWK_PRIVATE_PARAMS.intersection(jwk) check on context.trusted_root_keys: tests/test_delegation_module.py::test_verify_delegation_chain_rejects_private_jwk_members_in_trusted_root_keys
• max_depth <= JCS_SAFE_INTEGER check: tests/test_delegation_module.py::test_verify_delegation_chain_rejects_max_depth_above_safe_int
• len(set(lattice_list)) != len(lattice_list) check on context.data_class_lattice: tests/test_delegation_module.py::test_verify_delegation_chain_rejects_duplicate_data_class_lattice_entries
• Non-empty credential issuer and holder, 0 <= val <= JCS_SAFE_INTEGER on not_before/not_after, and not_before <= not_after: tests/test_delegation_module.py::test_verify_delegation_chain_rejects_invalid_credential_identities_and_windows
• visited: set[int] = {id(current)} initialization in verify_delegation_chain: tests/test_delegation_module.py::test_verify_delegation_chain_stops_at_first_return_to_leaf_in_cycle

Changelog entry

• Fixed (fix(delegation): reject private JWKs in trusted_root_keys, duplicate lattice entries, and invalid credential bounds #647). agentrust_trace.delegation.verify_delegation_chain now rejects RFC 7517/7518 private or symmetric JWK members in context.trusted_root_keys, duplicate entries in context.data_class_lattice, context.max_depth > 9007199254740991, empty credential issuer/holder strings, out-of-range or inverted credential not_before/not_after bounds, and seeds visited with the initial leaf record.

Checklist

• DCO sign-off on all commits (git commit -s)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[rajnisht7]

Batch response for this cluster is here: #653 (comment)