[drk-ram]

What and why

Closes #149

• Require 64-character lowercase hex (^[0-9a-f]{64}$) on registry_key and witness_key and 128-character lowercase hex (^[0-9a-f]{128}$) on checkpoint['signature'] in trace_verify._witness.verify.
• Reject non-finite JSON constants (NaN, Infinity, -Infinity) in trace_verify._witness.load_json.
• Add subTest-isolated regression tests in tests/test_witness_receipt.py independently mutating WITNESS_KEY and REGISTRY_KEY alongside signature and non-finite JSON inputs.

Validation

• python -m unittest discover -s tests -q — passed (407 tests)
• python -m pytest tests/test_witness_receipt.py -q — passed (31 passed, 22 subtests passed)
• python tools/validate_registry.py — passed (OK: 3 day file(s) valid)
• python tools/validate_producers.py — passed (OK: 3 producer key file(s) valid)
• python -m ruff check src/trace_verify/_witness.py tests/test_witness_receipt.py — passed (All checks passed!)

Registry impact

• This PR does not modify any existing line under registry/

Existing entries are append-only. If you are changing one, say why here: mirrors
and auditors may already have observed the current commit hashes, and a rewrite
diverges them.

Checks

• pytest passes
• Registry and producer files still validate (tools/validate_registry.py,
  tools/validate_producers.py)
• If the anchor format or verification semantics changed, docs/anchor-format.md
  is updated in the same PR, and existing inclusion proofs still verify
• Commits are signed off (DCO)

[rajnisht7]

the changes looks good, just one thing kindly expand the regression test right now it only hits NaN. Explicit cases for Infinity / -Infinity (and a couple of the other hex edges the new checks already reject)

[drk-ram]

Thanks @rajnisht7! Addressed in the latest commit: expanded test_non_canonical_hex_signature_or_keys_and_nonfinite_json_rejected in tests/test_witness_receipt.py to cover Infinity, -Infinity, odd/wrong-length hex ([:-2]), and non-hex characters ("zz" * 64 / "zz" * 32) alongside uppercase and whitespace-padded inputs.

[rajnisht7]

the expansion in 185ec39 is good overall, but it dropped the independent REGISTRY_KEY coverage that 0eaba72 had.

Currently bad_key is derived only from WITNESS_KEY and then passed to both parameters.

kindly mutate REGISTRY_KEY for the registry_key cases as well (at least .upper(), whitespace, truncated, non-hex), same as was done for WITNESS_KEY.

Something like:

for key, base in (('witness_key', WITNESS_KEY), ('registry_key', REGISTRY_KEY)):
    for bad in (base.upper(), '  ' + base, base[:-2], 'zz' * 32):
        with self.subTest(key=key, bad=bad):
            self.assertFalse(self.check(**{key: bad})['verified'])

[drk-ram]

Thanks @rajnisht7! Updated test_non_canonical_hex_signature_or_keys_and_nonfinite_json_rejected in tests/test_witness_receipt.py to mutate WITNESS_KEY and REGISTRY_KEY independently across .upper(), whitespace-prefixed, truncated ([:-2]), and non-hex ("zz" * 32) inputs.

[drk-ram]

Thanks @rajnisht7! Updated test_non_canonical_hex_signature_or_keys_and_nonfinite_json_rejected in tests/test_witness_receipt.py so for key, base in (('witness_key', WITNESS_KEY), ('registry_key', REGISTRY_KEY)) independently mutates WITNESS_KEY and REGISTRY_KEY across (base.upper(), ' ' + base, base[:-2], 'zz' * 32) and asserts the specific invalid lowercase hex {key} refusal alongside NaN, Infinity, -Infinity and signature edge cases, and rebased onto origin/main (ef6637f). Full unittest discovery (407 tests) and Ruff pass.