[drk-ram]

What

Reject duplicate JSON object keys and non-finite constants (NaN, Infinity) across ca2a_runtime.cli, ca2a_runtime.transport.server (/ca2a/task), and ca2a_runtime.transport.client, and enforce strict field types in cli._load_records and DelegationRecord.__post_init__.

Why

Closes #272.

Security impact

Prevents duplicate-key JSON smuggling on /ca2a/task, HTTP client responses, and CLI chain/DAG files, and prevents cli._load_records from splitting a string scope into single-character capabilities or coercing non-string fields via str(...).

Test plan

• pytest passes (pytest tests/unit/test_lineage_cli.py tests/unit/test_live_call.py tests/unit/test_provenance.py -q: 58 passed)
• ruff check passes (ruff check src/ca2a_runtime/provenance.py src/ca2a_runtime/cli.py src/ca2a_runtime/transport/server.py src/ca2a_runtime/transport/client.py tests/unit/test_lineage_cli.py: All checks passed!)
• mypy passes (mypy src/ca2a_runtime/provenance.py src/ca2a_runtime/cli.py src/ca2a_runtime/transport/server.py src/ca2a_runtime/transport/client.py: Success)
• Manual test performed

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head c36e4bb40037199f49dfc8b069f7eb96a5ca587e in an isolated checkout.

The CLI and unauthenticated HTTP JSON boundaries now reject duplicate members/non-finite constants, and required record/offer identifiers are checked as strings rather than coerced with str(). The authenticated task route retains its existing canonical decoder. No blocking source finding in the changed paths.

Fresh hash-locked Python 3.12.10 validation: 777 unit tests passed, 16 skipped; pip check, Ruff, mypy and Bandit passed. Sign-offs are present. git diff --check reports an extra blank line at test_lineage_cli.py EOF only. Required hosted checks and maintainer gates still need completion.

Reviewed with OpenAI Codex.

[rajnisht7]

@drk-ram Kindly resolve conflicts and rebase on main

[drk-ram]

@rajnisht7 Rebased onto origin/main (1889ce4) in 3726259.

[carloshvp]

Reviewed current head 37262598375ff22373f2740b3f2a115ffca3b4c3 in an isolated checkout.

The scoped input-hardening behavior passes source review and the full local unit/conformance suite (833 passed, 16 skipped). Ruff lint, mypy, configured Bandit and dependency consistency pass; the commit is signed off.

The required ruff format --check src/ tests/ job still fails on this head, while the same command passes on current main. Please run the pinned formatter on src/ca2a_runtime/cli.py, tests/unit/test_lineage_cli.py and rerun the format gate. The formatting diff is mechanical; no additional behavioral repair is requested by this review. Hosted CI and the independent security-review requirements still apply.

Reviewed with OpenAI Codex.

[dinakarjs]

The requested formatting correction is ready for author adoption: dinakarjs#3, commit 47515f7aaa848397fc423a5a2d5a0dcedeaed79f, based directly on this reviewed PR head. Pinned Ruff 0.17.1 formatting changes only; every changed Python AST is identical before/after. Final unit/conformance run: 847 passed, 2 skipped; Ruff format/lint, mypy, Bandit and whitespace checks pass. Environment and scope are recorded in the companion. Please cherry-pick into the existing PR and rerun hosted checks. This does not replace independent maintainer approval. DCO signed; prepared with Codex.

[drk-ram]

@carloshvp Amended and force-pushed 4af1465 (4af146506158cc279caf06c07480772869b910fc). ruff format --check src/ tests/ and ruff check src/ tests/ now pass with 0 errors.