[drk-ram]

What

Enforce canonical unpadded base64url in ca2a_runtime.transport._b64url.b64url_decode and reject non-string or empty claim fields in ca2a_runtime.transport.wire.parse_channel_offer.

Why

Closes #271.

Security impact

Prevents malleable non-canonical base64url encodings (non-zero trailing padding bits) in sealed_payload and hardware evidence fields (raw_evidence, quote_signature, attestation_key_pem, attestation_key_chain_pem) and prevents silent str(...) coercion of null, bool, int, or list values in channel offers.

Test plan

• pytest passes (pytest tests/unit/test_a2a_adapter.py tests/unit/test_peer_request.py tests/unit/test_caller_offer_relay.py -q: 85 passed)
• ruff check passes (ruff check src/ca2a_runtime/transport/_b64url.py src/ca2a_runtime/transport/wire.py tests/unit/test_a2a_adapter.py: All checks passed!)
• mypy passes (mypy --strict src/ca2a_runtime/transport/_b64url.py src/ca2a_runtime/transport/wire.py: Success)
• Manual test performed

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head b0852d7785ce0a76034724fb429b71d57dc537d4 in an isolated checkout.

The shared transport decoder rejects noncanonical encodings and the channel-offer parser validates nonempty string claims and mapping-shaped attestation. The six encoding regressions pass here; restoring the actual merge-base decoder/parser in process causes the three nonzero-pad-bit cases to fail their rejection assertions, while existing valid transport exchanges pass in the full suite.

Fresh hash-locked Python 3.12.10 validation: 817 unit tests passed, 16 skipped; pip check, Ruff, mypy and Bandit passed. Commit sign-offs are present. Please trim the extra blank line at test_a2a_adapter.py EOF. No blocking source finding; hosted CI and applicable security-maintainer approvals remain separate.

Reviewed with OpenAI Codex.

[rajnisht7]

@drk-ram Kindly rebase on main

[drk-ram]

@rajnisht7 Rebased onto origin/main (1889ce4) in 9a3a1b6.

[carloshvp]

Reviewed current head 9a3a1b6f9782f69de9714b4f57c50533418558ae in an isolated checkout.

The scoped input-hardening behavior passes source review and the full local unit/conformance suite (873 passed, 16 skipped). Ruff lint, mypy, configured Bandit and dependency consistency pass; the commit is signed off.

The required ruff format --check src/ tests/ job still fails on this head, while the same command passes on current main. Please run the pinned formatter on tests/unit/test_a2a_adapter.py and rerun the format gate. The formatting diff is mechanical; no additional behavioral repair is requested by this review. Hosted CI and the independent security-review requirements still apply.

Reviewed with OpenAI Codex.

[dinakarjs]

The requested formatting correction is ready for author adoption: dinakarjs#4, commit d0395bce04c20f46398214e4b5b8e592ae80f224, based directly on this reviewed PR head. Pinned Ruff 0.17.1 formatting changes only; every changed Python AST is identical before/after. Final unit/conformance run: 887 passed, 2 skipped; Ruff format/lint, mypy, Bandit and whitespace checks pass. Environment and scope are recorded in the companion. Please cherry-pick into the existing PR and rerun hosted checks. This does not replace independent maintainer approval. DCO signed; prepared with Codex.

[drk-ram]

@carloshvp Amended and force-pushed f231b13 (f231b13c8afb5f98dacdbac71e1dc0a3c9046778). ruff format --check src/ tests/ and ruff check src/ tests/ now pass with 0 errors.