[imran-siddique]

Closes #142.

Four structural rules lived only in build_record:

• a tee-attested record must carry attestation evidence
• an endpoint identity must carry spki_sha256
• an artifact identity must carry digest
• issued_at must be a usable timestamp

A record does not have to come from build_record. Anyone can write the JSON and sign it, so a rule on the producer side is a rule an attacker never runs. @lywinged's reproduction on #142 shows the consequence: a record claiming kind: "tee-attested" with attestation: null, an endpoint identity that is a bare URL, and no issued_at, signed by a key the consumer already trusts, passes both steps of §5. The consumer is handed the top trust tier with nothing behind it.

The rules move into a single _check_structure that both build_record and verify_record call. Copying them into the verifier would have worked today and drifted later, and the copy that matters is the consumer's.

This is the same principle #144 made explicit in the C2PA assertion next door: a check a verifier must not be able to skip is required, not offered. @lywinged drew that connection on the issue.

Tests. Nine cases, one per rule plus the reported forgery verbatim and a well-formed control. Run against the currently published agentrust-trace, eight of the nine fail and the control passes, so they are guarding the actual defect.

Compatibility. This rejects records the verifier previously accepted. Every such record is one build_record would have refused to emit, so anything produced through the SDK is unaffected.

🤖 Generated with Claude Code

[lywinged]

Thanks, pulling the structural rules onto the verify path via one _check_structure
is exactly it, and rejecting bool for issued_at is a nice catch I'd missed.

Two smaller things from the bottom of #142 are in the same function and untouched by
this PR, if you want them in the same pass:

• The regexes still anchor with $ (lines 43–44). In Python $ matches before a single
  trailing newline, so publisher = "did:web:acme.example\n" and a tool_catalog.hash
  with one trailing newline both still pass verify_record. \Z is the intended anchor.
  (The hash case fails safe — check_tool_catalog rejects it on the != — but the
  publisher one does not.)

• The embedded-key guard is embedded != trusted_jwk (line 253), a dict comparison, so
  a legitimately signed record whose cnf.jwk carries an extra member like kid is
  refused even though the key material is identical. Comparing key material, or the JWK
  thumbprint, would avoid turning away honest publishers.

Both are minor next to the main fix; flagging only because they're the same few lines
you're already in.