feat(identity): UCP profile signing helpers (1.3.7) - #14

Merged

vvillait88 merged 40 commits into

mainfrom

feat/ucp-signing

May 10, 2026

Commits on May 8, 2026

feat(identity): UCP profile signing helpers (joserfc optional extra)

vvillait88
and
claude
committed
0884d10
chore(deps): refresh transitive deps

vvillait88
and
claude
committed
bacfc5e
hardening(identity): UCP signing security + ergonomics fixes

vvillait88
and
claude
committed
7e6d6ed
hardening: round-2 reviewer findings (security + test gaps)

vvillait88
and
claude
committed
df383ff
hardening: round-3 reviewer findings (HIGH JWS header guard + parity)

vvillait88
and
claude
committed
afc7c3c
hardening: round-4 reviewer findings (warning scope + edge tests + README codes)

vvillait88
and
claude
committed
757dedf
hardening: round-5 reviewer findings (alg-mismatch + warning scope + non-ASCII keys fixture)

vvillait88
and
claude
committed
4373205

Commits on May 9, 2026

hardening: round-6 reviewer findings (cross-lang corpus + extras + reject set)

vvillait88
and
claude
committed
9c2e098
fix(ucp): round-7 review parity fixes

vvillait88
and
claude
committed
2fed413
hardening: round-9 reviewer findings (int-boundary cross-lang parity)

vvillait88
and
claude
committed
ea80759
hardening: round-11 reviewer findings (typed-error contract + dict-key parity)

vvillait88
and
claude
committed
2042ed2
hardening: round-17 reviewer findings (crit precedence cross-lang parity)

vvillait88
and
claude
committed
a4fd2f5
fix(ucp): treat JWS crit=null as malformed_jws

vvillait88
and
claude
committed
81ffd00
hardening(identity): reject U+2028/U+2029 in profile canonicalization

vvillait88
and
claude
committed
3013392
docs(identity): fix sign_ucp_profile docstring example constructor

vvillait88
and
claude
committed
7fe7f32
hardening(identity): align build_ucp_profile claims coalescing with node sibling

vvillait88
and
claude
committed
acda956
hardening(identity): typed-field fallback + per-element extras guard + set/frozenset reject

vvillait88
and
claude
committed
48bced1
hardening(identity): round-26 UCP signing reviewer findings

vvillait88
and
claude
committed
1bc9ef3
hardening(identity): reject crit array with non-string elements per RFC 7515

vvillait88
and
claude
committed
2f598ca
hardening(identity): align UCP read order to typed-first + reject bytes

vvillait88
and
claude
committed
4dfee92
hardening(identity): make AssessResult.account_verification a typed field

vvillait88
and
claude
committed
c00d51b
hardening(identity): typed-empty wins over raw + preserve empty payment_handler config

vvillait88
and
claude
committed
63a7ee2
docs(ucp): clarify raw fallback as Python-only legacy escape hatch

vvillait88
and
claude
committed
3198c84
chore(deps): refresh uv.lock

vvillait88
and
claude
committed
e0aedc1
docs: scrub em dashes and refresh examples README

vvillait88
and
claude
committed
4b9571e
hardening(examples): sanitize UCP self-test exception, drop unused Any import

vvillait88
and
claude
committed
7144c52
feat(identity): vendor-namespace UCP signing typ + capability name (1.4.0)

vvillait88
and
claude
committed
6745320
fix(identity): align hand-crafted capability fixture schema URL with SDK

vvillait88
and
claude
committed
09e0f71
fix(identity): unwrap doubly-nested extras in py emoji-keys + int-boundary cross-lang regenerator

vvillait88
and
claude
committed
bd81dfe
fix(identity): align UCPPaymentHandler config emission with Node optional convention

vvillait88
and
claude
committed
644fdc2
chore(scripts): remove standalone fixture generators shadowed by orchestrator

vvillait88
and
claude
committed
d487d61
fix(identity): coerce both-empty verified_at to None for cross-lang parity

vvillait88
and
claude
committed
c516f43

Commits on May 10, 2026

fix(identity)!: spec-compliant UCP profile shape (ucp envelope + map-keyed bindings)

vvillait88
and
claude
committed
fa0bc9a
docs: update README + signed_ucp_merchant example for new spec-compliant shape

vvillait88
and
claude
committed
bcd1060
fix(identity): regenerate cross-lang fixture corpus for spec-compliant shape

vvillait88
and
claude
committed
408d6ee
docs(claude): add signed_ucp_merchant.py to examples table (parity with node)

vvillait88
and
claude
committed
1b40810
fix(identity): validate kid/kty are non-empty strings in UCPSigningKey.from_jwk

vvillait88
and
claude
committed
05018cc
feat(a2a): add UCP extension declaration to A2A agent card builder

vvillait88
and
claude
committed
e07eaaa
fix(identity): pin parity behavior + README example for A2A extensions

vvillait88
and
claude
committed
57d212d
chore(deps): bump safe minors+patches in lockfile

vvillait88
and
claude
committed
817b59d