specs: accept JSON whitespace in token and identity responses - #32
Closed
Wondertan wants to merge 1 commit into
Closed
specs: accept JSON whitespace in token and identity responses#32Wondertan wants to merge 1 commit into
Wondertan wants to merge 1 commit into
Conversation
Define one grammar for token and identity field prefixes while preserving original bytes, contiguous reveals, bearer-only commitments and duplicate detection. Assisted-by: GPT-6 Signed-off-by: Wondertan <hlibwondertan@gmail.com>
This was referenced Sep 10, 2026
xgreenx
added a commit
that referenced
this pull request
Sep 11, 2026
GitHub pretty-prints `/user` for the media type the profile pins, so the compact delimiters this specification spells matched nothing it serves. REQ-COMMON-19F fixes what libid-org/libid-contracts#37 does: the Platform Verifier removes the JSON whitespace touching a structural byte and matches, counts and reads over what is left; the Implementation reveals a member as the wire carried it, whitespace inside, and never commits that whitespace with a bearer; the compact spellings name the member after removal. TEST-COMMON-10A lists the vectors. REQ-PLAT-51 judges GitHub's terminator after that removal and REQ-PLAT-60 keeps the whitespace in the reveal. Carries the vectors of #32 in the form the merged verifier implements. Co-authored-by: Wondertan <hlibwondertan@gmail.com> Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: xgreenx <xgreenx9999@gmail.com>
Contributor
|
Closing in favor of #31, which now carries this rule as REQ-COMMON-19F with TEST-COMMON-10A — in the form the merged verifier implements: libid-org/libid-contracts#37 removes the JSON whitespace touching a structural byte before it matches, counts and reads, rather than matching a whitespace-aware delimiter as #36 did. The one sentence here that verifier cannot satisfy is "MUST NOT reconstruct it by dropping whitespace"; everything else — bytes revealed at their offsets, one contiguous range, bearer without prefix whitespace, duplicates counted across spellings, the GitHub terminator — is in #31, and your vector list was the base for TEST-COMMON-10A, credited as co-author. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub’s real
/userresponse contains valid JSON whitespace after colons, but the compact field templates reject it. Define JSON whitespace consistently for X/GitHub token and identity transcript readers, including whitespace before integer terminators. Preserve original attested bytes, contiguous reveal ranges, bearer-only commitments, canonical values, and duplicate detection across accepted spellings.Adds REQ-COMMON-19F and TEST-COMMON-10A, and aligns the GitHub terminator requirement. OIDC circuit extraction is outside this change.
Stacked on #31 so its header/framing updates remain authoritative. This is the specification prerequisite for ceremony #28, libid-rs #20, and contracts #36; a separate Bridge patch consumes the Rust fix.
Validation: security/correctness, API/ownership and simplicity reviews are clear. Companion implementations passed 296 TypeScript, 54 Rust transcript and 318 contract tests. Spec lint retains pre-existing suite findings; no new findings were introduced.
Standalone Bridge implementation: libid-server-rs #11, based on token-exchange PR #8 without callback/localhost prerequisites.