diff --git a/agentscore_commerce/aip/http_signature.py b/agentscore_commerce/aip/http_signature.py index e9f4e2f..30122e4 100644 --- a/agentscore_commerce/aip/http_signature.py +++ b/agentscore_commerce/aip/http_signature.py @@ -21,7 +21,7 @@ ``Signature-Input`` / ``Signature`` dictionaries (a parenthesized inner list + integer/string params, and a single byte-sequence value). It is not a general RFC 8941 parser. -Byte-compatibility: this is a behaviour-exact port of the reference ``aip/http-signature.ts``. +Byte-compatibility: this is a behavior-exact port of the reference ``aip/http-signature.ts``. A node/pay-signed proof-of-possession MUST verify here and vice versa. The signature base, component ordering, canonicalization, the standard (not base64url) base64 of the signature value, and the RFC 7638 thumbprint are all reproduced byte-for-byte. diff --git a/agentscore_commerce/aip/jwks.py b/agentscore_commerce/aip/jwks.py index 90689a5..5205f3f 100644 --- a/agentscore_commerce/aip/jwks.py +++ b/agentscore_commerce/aip/jwks.py @@ -18,7 +18,7 @@ Pure-ish: the only I/O is the HTTP fetch, injectable for tests via ``fetch_impl``. -This is a behaviour-exact port of the reference implementation; the canonicalization, +This is a behavior-exact port of the reference implementation; the canonicalization, caching, and selection logic mirror that file line-for-line so an AIT verified by one SDK resolves the same key set in the other. """ @@ -225,7 +225,7 @@ def json(self) -> Any: class JwksCache: """JWKS resolver bound to a trusted-issuer allowlist. - One instance can serve many issuers; each issuer's key set is cached independently. Behaviour + One instance can serve many issuers; each issuer's key set is cached independently. Behavior mirrors the reference ``JwksCache``. """ diff --git a/tests/test_policy.py b/tests/test_policy.py index 5c0339e..074ddef 100644 --- a/tests/test_policy.py +++ b/tests/test_policy.py @@ -224,7 +224,7 @@ async def test_run_gate_soft_does_not_swallow_sanctions_unavailable() -> None: @pytest.mark.asyncio async def test_run_gate_soft_does_not_swallow_signer_sanctions_error_code() -> None: # A signer-sanctions SDN deny that surfaces as a top-level error.code (not in reasons) - # is still recognised as a sanctions deny and stays terminal under soft. + # is still recognized as a sanctions deny and stays terminal under soft. from agentscore_commerce.identity.fastapi import _GateDenialError body = {"error": {"code": "sanctions_flagged", "message": "signer on SDN list"}}