René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"fix(capture-core): reject duplicate JSON keys and non-finite numbers in load_state/sha_mapping and check seal.alg in check_seal","articleBody":"### Summary\n\nThree state-integrity boundary gaps exist in `packages/agentrust-capture-core/src/agentrust_capture_core/`:\n\n1. **Duplicate JSON keys and non-finite constants accepted in `load_state` (`packages/agentrust-capture-core/src/agentrust_capture_core/state.py` lines 65-80):**\n   - `load_state(path)` calls bare `json.loads(path.read_text(encoding=\"utf-8\"))` without `object_pairs_hook` or `parse_constant`, accepting state/baseline files with duplicate JSON keys or `NaN`/`Infinity` constants instead of returning `None` (corrupt state).\n\n2. **`allow_nan=True` default in `sha_mapping` (`packages/agentrust-capture-core/src/agentrust_capture_core/hashing.py` lines 76-80):**\n   - `sha_mapping(value)` calls `json.dumps(value, sort_keys=True, separators=(\",\", \":\"))` without `allow_nan=False`, allowing `NaN` and `Infinity` to serialize into non-standard JSON before hashing.\n\n3. **Unchecked `seal[\"alg\"]` in `check_seal` (`packages/agentrust-capture-core/src/agentrust_capture_core/seal.py` lines 61-71):**\n   - `attach_seal` writes `{\"alg\": \"SHA-256\", \"digest\": state_digest(snapshot), \"sealed_at\": ...}`, but `check_seal` only checks `isinstance(seal.get(\"digest\"), str)` and `seal[\"digest\"] == state_digest(snapshot)`, returning `INTEGRITY_OK` even when `seal.get(\"alg\") != \"SHA-256\"`.\n\n### Proposed Fix\n\n- Reject duplicate JSON keys and `NaN`/`Infinity` constants in `load_state` (returning `None`).\n- Pass `allow_nan=False` to `json.dumps` in `sha_mapping`.\n- Check `seal.get(\"alg\") == \"SHA-256\"` in `check_seal`, returning `INTEGRITY_BROKEN` when `\"alg\"` is present and not `\"SHA-256\"`.","author":{"url":"https://github.com/drk-ram","@type":"Person","name":"drk-ram"},"datePublished":"2026-10-23T23:03:00Z","url":"https://github.com/agentrust-io/integrations/issues/366"}