[drk-ram]

Closes #379

Summary

• Reject boolean iat, exp, and instance_id (and empty instance_id) in make_gcp_placement_assertion.
• Validate type(validity_seconds) is int and validity_seconds > 0 and canonical 64-char lowercase hex workload_key across make_placement_assertion, make_azure_placement_assertion, and make_gcp_placement_assertion.
• Enforce canonical unpadded 64-byte base64url signatures and 64-char lowercase hex trusted_key_hex in agentrust_auc.core._unb64 and _verify_signed.
• Add unit tests in examples/sovereign-agent-connector/tests/test_appraisal.py.

Validation

• pytest examples/sovereign-agent-connector/tests/test_appraisal.py -q — passed (14 passed)

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head c17d8244b79cda2624fc6477ce0a4ceeff8f0970 in an isolated checkout.

The software example rejects boolean GCP numeric claims, invalid validity intervals, malformed public-key hex and noncanonical/wrong-length signatures, while preserving the valid signed placement/appraisal controls. All 53 example tests pass; the focused control fails with the baseline appraisal/core modules restored. I resolved the example's declared requirements into a fresh local hash lock; pip check, scoped example/repository Ruff and diff whitespace checks pass. Operator placement assertions, verified token claims and hardware evidence remain separate. No blocking finding in the changed example; hosted CI and maintainer policy remain separate.

Reviewed with OpenAI Codex.