[drk-ram]

What

Validate secret (bytes of length >= 16), exact int ttl_seconds and now, and ASCII decimal expiry in ca2a_runtime.challenge, and validate iat (positive RFC 8785 safe int), subject, credential_id, parent_record_hash, and non-empty hops in ca2a_runtime.trace_binding.

Why

Closes #285.

Security impact

Prevents verify_challenge(..., now=False) from treating the current time as epoch 0 (making expired challenges appear unexpired), rejects empty/short HMAC challenge secrets, and prevents boolean/float/out-of-range iat or empty non-root credential_id in signed TRACE records.

Test plan

• pytest passes (pytest tests/unit/test_challenge.py -q: 45 passed)
• ruff check passes (ruff check src tests/unit/test_challenge.py: All checks passed!)
• mypy passes
• Manual test performed

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head ce7721ff4a06a5a0500776fa7a2452be285eb80a in an isolated checkout.

[P2] Preserve the domain-error contract when converting a decimal expiry.

The new ASCII/decimal precheck removes the earlier try/except around int(expiry_str). With a valid secret and a syntactically shaped challenge whose expiry contains 4,301 ASCII decimal digits, Python 3.12's default integer-string limit raises ValueError at src/ca2a_runtime/challenge.py. verify_challenge documents AttestationFailed for a malformed/unissued challenge; the actual merge-base implementation returned that domain error for this same input. The new ValueError escapes instead.

Please keep the ASCII/decimal guard and translate a ValueError from int(expiry_str) back into AttestationFailed, or reject an excessive expiry length through that domain error before conversion. A focused in-process correction restoring the catch produces AttestationFailed for the oversized input while the valid issued-challenge control still passes. Add that regression alongside the non-decimal cases. This is a demonstrated error-contract regression; no authentication bypass is claimed.

The ordinary exact-head suite passes (800 passed, 16 skipped), as do pip check, Ruff, mypy, configured Bandit, sign-offs and diff whitespace checks. Requesting the narrow conversion-error repair before approval.

Reviewed with OpenAI Codex.

[drk-ram]

Thank you @carloshvp! Addressed in d32fe0d (rebased onto origin/main at 1889ce4):

• Kept the expiry_str.isascii() and expiry_str.isdecimal() precheck and restored try: expiry = int(expiry_str) except ValueError as exc: raise AttestationFailed("challenge expiry is not an integer") from exc in src/ca2a_runtime/challenge.py.
• Added the 4,301-digit decimal expiry case (f"v1.{'9' * 4301}.{'a' * 32}.{'0' * 64}") to test_verify_challenge_rejects_non_str_and_non_decimal_expiry in tests/unit/test_challenge.py.

[carloshvp]

Reviewed current head d32fe0d00c90da939e20f239d10d95be8b845fb8 in an isolated checkout.

The oversized decimal-expiry conversion now translates the integer-conversion limit into AttestationFailed; the 4,301-digit regression reaches that path. The secret/TTL/time and TRACE binding validations remain intact. This resolves my earlier challenge-parser change request.

Fresh Python 3.12.10 validation: 857 passed, 16 skipped; Ruff, mypy and configured Bandit pass. The installed dependencies are consistent, and the PR commit carries a DCO sign-off. The required format check and whitespace check pass. Hosted CI and the required independent security approvals remain separate.

Reviewed with OpenAI Codex.