[drk-ram]

What this changes

Hardens URI, explicit-null, and string-digest checks across five conformance modules (TR-RTE, TR-ANC, TR-TXN, TR-SCA, and TR-POL):

1. String-type check before regex digest matching (TR-RTE-002, TR-TXN-001, TR-SCA-002, TR-POL-001, TR-POL-003):
   Requires isinstance(value, str) before calling _DIGEST_RE.fullmatch(...) rather than coercing arbitrary Python objects via str(...), so non-string objects whose __str__ returns a digest string are rejected by programmatic callers of trace_tests.modules.*.check(...).
2. Explicit JSON null rejection on optional fields (TR-RTE-003, TR-TXN-002):
   Skips TR-RTE-003 (runtime.rim_uri) and TR-TXN-002 (tool_transcript.call_count) only when the key is absent from the parent dictionary ("rim_uri" not in runtime and "call_count" not in txn). When the key is present with None (explicit JSON null), the check emits Status.FAIL, matching TR-APR-003, TR-APR-004, and schemas/trace-claim.json.
3. HTTPS URI host and character validation (TR-RTE-003, TR-ANC-001):
   • TR-RTE-003 validates runtime.rim_uri via _valid_https_uri, requiring scheme == "https", a non-empty netloc, and no whitespace or control characters (ch.isspace() or ord(ch) < 0x20 or ord(ch) == 0x7F).
   • TR-ANC-001 rejects transparency URIs containing whitespace or control characters alongside the existing https scheme and non-empty netloc checks.

Closes #570
Contributor: Raghuvar Durga (@drk-ram)

Independent review verified that conformance/measurement/scripts/mutate_modules.py mutates every Status.FAIL site in conformance/src/trace_tests/modules/tr_*.py and requires every site to fail at least one test in conformance/tests/. Kept TR-RTE-003 and TR-ANC-001 to their single URI-shape Status.FAIL sites and added unit coverage in conformance/tests/unit/test_tr_rte.py for missing/empty runtime.nonce at Level 1 so all 27 measured checks report unverified : 0.

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

No normative spec text changes; aligns conformance module checks in conformance/src/trace_tests/modules/ with spec/trace-v0.2.md section 3.1 and conformance/schemas/trace-claim.json.

Tests for a fix

Added tests/test_conformance_module_uri_and_null_boundaries.py and unit tests in conformance/tests/unit/test_tr_{rte,anc,txn,sca,pol}.py.

Validation commands and results:

• pytest conformance/tests: passed (798 passed, 5 xpassed)
• pytest tests/test_conformance_module_uri_and_null_boundaries.py: passed (12 passed)
• python conformance/measurement/scripts/mutate_modules.py conformance: passed (checks measured : 27, verified : 27, unverified : 0)
• python tools/review_bar.py --base origin/main --head HEAD: passed (12 fail on behaviour, 0 fail on a missing name or file, 0 pass or skip against merge base)
• python tools/check_dashes.py: passed (no dashes outside examples/, spec/trace-v0.1.md)
• ruff check: passed (All checks passed!)
• mypy --strict tests/test_conformance_module_uri_and_null_boundaries.py: passed (Success: no issues found in 1 source file)

Each of the 12 test cases in tests/test_conformance_module_uri_and_null_boundaries.py fails on behaviour when run against origin/main:

• test_tr_rte_003_rejects_null_and_malformed_https_uris[explicit-null]
• test_tr_rte_003_rejects_null_and_malformed_https_uris[empty-host]
• test_tr_rte_003_rejects_null_and_malformed_https_uris[whitespace]
• test_tr_rte_003_rejects_null_and_malformed_https_uris[control-char]
• test_tr_anc_001_rejects_https_uri_with_whitespace_or_control_chars[space]
• test_tr_anc_001_rejects_https_uri_with_whitespace_or_control_chars[newline]
• test_tr_anc_001_rejects_https_uri_with_whitespace_or_control_chars[nul]
• test_tr_txn_002_rejects_explicit_null_call_count
• test_tr_rte_002_rejects_non_string_digest_object
• test_tr_sca_002_rejects_non_string_digest_object
• test_tr_txn_001_rejects_non_string_digest_object
• test_tr_pol_001_and_003_reject_non_string_digest_object

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)

[dinakarjs]

Reviewed exact head e28e8f3. Independent Linux/Python 3.12.14 with matching hash-locked dependencies and exact source paths: 12 new boundary tests and 800 conformance tests pass, with 5 existing XPASS outcomes. Initial conformance execution lacked installed distribution metadata; the complete rerun after installing local package metadata passes. The digest-type and explicit-null changes behave as intended.

One residual URI-shape gap: _valid_https_uri and TR-ANC-001 treat a nonempty netloc as a nonempty host. Those are different. Direct local checks still accept https://:443/rim and https://user@/rim, whose parsed hostname is None, alongside the valid https://example.invalid/rim control. The current new helper and success messages call these well-formed/valid HTTPS URIs. This is a conformance pointer-shape finding, not a demonstrated network request, signature or anchor-inclusion bypass.

Please validate the parsed host and safely handle invalid port/authority forms in the same shared URI-shape contract, with positive twins and missing-host/invalid-authority regressions. Preserve optional-field omission behavior and do not add unrelated network/reachability policy. DCO/whitespace checked; all returned technical workflows succeed, Dependabot skipped. Reviewed with OpenAI Codex assistance.

[dinakarjs]

Prepared a focused, DCO-signed author-adoption companion: d5c6627c, directly atop reviewed head e28e8f381417ed7d99e6f9ddcc1ce84ce3c71cbd.

Uses one shared HTTPS pointer-shape helper for TR-RTE-003 and TR-ANC-001: a real parsed hostname is required and the lazy port accessor is validated. Existing parse-error reporting and omission behavior remain. Twenty paired cases include ordinary hosts, IPv6 and userinfo positives plus missing-host and malformed-port negatives. Full conformance suite: 820 pass / 5 existing XPASS; Ruff, targeted mypy, dash and whitespace checks pass. Removing hostname or port validation separately causes 4 assertion failures while 16 cases pass. This checks pointer shape, not endpoint trust or anchor inclusion.

Reference: primary technical source. It informs the implementation/packaging boundary; it is not independent approval or a general security guarantee. The commit message retains the reference too.

For adoption: fetch https://github.com/dinakarjs/trace-spec.git branch fix/576-https-pointer-authority and cherry-pick d5c6627c2a411700b0485db568f7e5ec137dc832. The published tree equals the tested tree d98885e13e785992c37d8a3b26c4402da06939d1.

I have not changed this PR's head or converted the existing changes request into approval. Please adopt or adjust the companion, run the original final-head checks and obtain independent review. Prepared with Codex; original ownership is retained.

[dinakarjs]

Checked new head f28c903 against the previously reviewed e28e8f3. The relevant tr_rte.py, tr_anc.py and boundary test file are byte-unchanged; this head does not yet incorporate the URI-authority correction. Direct local checks still accept https://:443/rim, https://user@/rim and https://example.invalid:bad/rim in both pointer-shape checks; the valid https://example.invalid/rim control also passes. This is the existing shape-validation finding, not a new network or inclusion claim.

The previously supplied DCO-signed companion d5c6627 remains available in comment 6273501181. Please adopt or adjust it before re-requesting review. The current returned technical workflows pass (Dependabot skipped), but those checks do not close this demonstrated gap. My existing changes request remains. Primary reference and paired regression/mutation evidence are retained in the companion handoff. Reviewed with OpenAI Codex assistance.

[imran-siddique]

@drk-ram f28c903 is a rebase. tr_rte.py, tr_anc.py and the boundary test are unchanged from e28e8f3, so https://:443/rim, https://user@/rim and https://example.invalid:bad/rim still pass TR-RTE-003 and TR-ANC-001 here.

d5c6627 cherry-picks cleanly onto f28c903. With it, all three fail, https://[::1]/rim still passes, and the conformance suite runs 882 passed, 5 xpassed. Please adopt it and re-request review from @dinakarjs.

[drk-ram]

Thanks @imran-siddique and @dinakarjs! Cherry-picked d5c6627c onto f28c903b (3497fd3), added a bracketed-IPv6 authority tail check in _https_uri.py so https://[::1]suffix/rim is also rejected on Python 3.11 (where urllib.parse.urlsplit did not yet reject non-:port suffixes after ]), and expanded tests/test_conformance_module_uri_and_null_boundaries.py with the authority/port cases (18 fail on behaviour, 0 fail on a missing name or file in review_bar.py; 882 passed, 5 xpassed in conformance/tests; unverified : 0 in mutate_modules.py). Ready for re-review @dinakarjs.

[dinakarjs]

Incorporation verification at 3497fd3: The shared HTTPS-pointer helper now validates hostname and lazy port parsing in both consumers. The additional bracket-tail check explicitly rejects a non-port suffix after an IPv6 closing bracket. All 18 focused URI/null boundary tests pass on Linux/Python 3.12.14. I inspected the Python 3.11 compatibility correction but did not execute that interpreter locally.

This closes my correction-incorporation action. Because this PR incorporates my contributed correction, this COMMENT is not independent approval of that correction. Required independent review and current-head hosted gates remain. Validation covers the stated controls, not endpoint trust or a wider production assurance claim. Reviewed with Codex.

[rajnisht7]

The overall changes looks good, a few things to address:

• kindly reject full C1 range (or switch to unicodedata.category(ch) == "Cc") and add at least one C1 regression on both surfaces.
• also remove the dead urlparse path in tr_anc so the shared helper is the single authority.