Harden recursive trust metadata validation

Author: rozmiarD

CHANGELOG.md

@@ -6,6 +6,9 @@ GovEngine follows conservative pre-1.0 versioning while the API boundary is stil
 
 ## Unreleased
 
+- Applies the shared bounded-JSON limits to key-resolution and trust-store
+  adapter records, and rejects forbidden trust-material keys recursively across
+  nested mappings, lists and tuples.
 - Removes the unconsumed `govengine.contracts.execution` package and the
   runtime-owned `govengine.execution.command_shape` helper. RExecOp now owns
   argv normalization at its connector boundary, and clean-install/public-truth

SECURITY.md

@@ -42,4 +42,6 @@ New safety-sensitive code should be deterministic by default, testable without l
 - approved vs prepared execution shape;
 - dry-run/local/mock/live truth;
 - receipt/evidence non-claims;
+- bounded, recursively filtered metadata at key-resolution and trust-store
+  adapter boundaries;
 - owner-review boundaries.

docs/API_STABILITY_MATRIX.md

@@ -63,7 +63,7 @@ or host-specific Ravenclaw/Tecrax runtime behavior.
 | experimental | govengine.runtime_shell | `GovControlAction`, `GovQueueLane`, `GovQueueSnapshot`, `GovRuntimeSnapshot`, `GovSchedulerTick`, `control_action_from_host_action`, `queue_snapshot_from_lanes`, `validate_control_action`, `validate_queue_snapshot`, `validate_runtime_snapshot`, `validate_scheduler_tick` | Host-provided runtime shell projection; no scheduler/storage/live-execution authority. |
 | adapter | govengine.sclite_contracts lazy exports | `GovSCLiteLifecycleVerifier`, `review_bundle_state`, `review_bundle_transition_decision`, `review_sclite_bundle`, `verify_lifecycle_manifest` | Lazy SCLite bridge exports; SCLite owns lifecycle and review verification. |
 | adapter | govengine.scope_ports | `FunctionalScopePort`, `GovScopePort` | Host-neutral scope port protocols/helpers. |
-| adapter | govengine.signing | `KeyResolutionRequest`, `KeyResolutionResult`, `KeyResolverPort`, `SignatureEnvelope`, `SignedArtifact`, `SigningPolicy`, `TrustPolicy`, `TrustStoreDecision`, `TrustStorePort`, `VerificationResult`, `canonical_govengine_record`, `govengine_record_digest`, `signed_artifact_from_record`, `signature_transition_decision`, `verify_signed_govengine_record` | Host-provided signer/verifier/key-resolver/trust-store decision records plus deterministic serialization/digest, signed-envelope helpers, and signature transition decisioning for GovEngine-owned records only; no SCLite canonicalization, PKI/KMS, or key-store ownership. |
+| adapter | govengine.signing | `KeyResolutionRequest`, `KeyResolutionResult`, `KeyResolverPort`, `SignatureEnvelope`, `SignedArtifact`, `SigningPolicy`, `TrustPolicy`, `TrustStoreDecision`, `TrustStorePort`, `VerificationResult`, `canonical_govengine_record`, `govengine_record_digest`, `signed_artifact_from_record`, `signature_transition_decision`, `verify_signed_govengine_record` | Host-provided signer/verifier/key-resolver/trust-store decision records plus deterministic serialization/digest, signed-envelope helpers, and signature transition decisioning for GovEngine-owned records only. Key-resolution and trust-store metadata is bounded JSON and rejects trust-material keys recursively through mappings and collections; GovEngine still owns no SCLite canonicalization, PKI/KMS, or key store. |
 | fixture | govengine.signing demo helpers | `DemoDigestSigner`, `DemoDigestVerifier`, `demo_sign_and_verify`, `demo_sign_govengine_record` | Deterministic demo-only signer/verifier helpers; not cryptographic identity proof. |
 | experimental | govengine.state_index | `ArtifactStateIndex` | Lightweight artifact state summary helper. |
 | experimental | govengine.state_machine | `GovRunState`, `StateTransition`, `apply_state_transition`, `validate_run_state`, `validate_state_transition` | Neutral run-state transitions; no persistence/scheduler/live-execution authority. |

govengine/signing.py

@@ -8,6 +8,7 @@
 from string import hexdigits
 from typing import Any, Mapping, Protocol
 
+from govengine._json_boundary import bounded_json_copy
 from govengine.api import GovApiError, require_mapping
 from govengine.core import ArtifactDescriptor, GovernanceContext, ReasonCode, TransitionDecision
 
@@ -146,8 +147,9 @@ def __post_init__(self) -> None:
 
     @classmethod
     def from_mapping(cls, value: Mapping[str, Any]) -> "KeyResolutionResult":
-        raw = require_mapping(value, reason_code="invalid_key_resolution_result")
-        _reject_forbidden_trust_material(raw)
+        raw = _bounded_trust_mapping(
+            require_mapping(value, reason_code="invalid_key_resolution_result")
+        )
         metadata = raw.get("metadata") if isinstance(raw.get("metadata"), Mapping) else {}
         return cls(
             status=str(raw.get("status") or ""),
@@ -195,8 +197,9 @@ def __post_init__(self) -> None:
 
     @classmethod
     def from_mapping(cls, value: Mapping[str, Any]) -> "TrustStoreDecision":
-        raw = require_mapping(value, reason_code="invalid_trust_store_decision")
-        _reject_forbidden_trust_material(raw)
+        raw = _bounded_trust_mapping(
+            require_mapping(value, reason_code="invalid_trust_store_decision")
+        )
         metadata = raw.get("metadata") if isinstance(raw.get("metadata"), Mapping) else {}
         return cls(
             status=str(raw.get("status") or raw.get("trust_status") or ""),
@@ -435,14 +438,27 @@ def _validate_govengine_record_digest(record_digest: str) -> str:
 
 def _bounded_trust_metadata(value: Mapping[str, Any] | None) -> dict[str, Any]:
     metadata = value if isinstance(value, Mapping) else {}
-    _reject_forbidden_trust_material(metadata)
-    return dict(metadata)
+    return _bounded_trust_mapping(metadata)
+
 
+def _bounded_trust_mapping(value: Mapping[str, Any]) -> dict[str, Any]:
+    copied = bounded_json_copy(value)
+    if not isinstance(copied, dict):
+        raise GovApiError("invalid_trust_metadata")
+    _reject_forbidden_trust_material(copied)
+    return copied
 
-def _reject_forbidden_trust_material(value: Mapping[str, Any]) -> None:
-    for key in value:
-        if str(key).lower() in FORBIDDEN_TRUST_MATERIAL_KEYS:
-            raise GovApiError("forbidden_trust_material")
+
+def _reject_forbidden_trust_material(value: Any) -> None:
+    if isinstance(value, Mapping):
+        for key, nested in value.items():
+            if key.strip().lower() in FORBIDDEN_TRUST_MATERIAL_KEYS:
+                raise GovApiError("forbidden_trust_material")
+            _reject_forbidden_trust_material(nested)
+        return
+    if isinstance(value, (list, tuple)):
+        for nested in value:
+            _reject_forbidden_trust_material(nested)
 
 
 def _canonical_record_value(value: Any) -> Any:

tests/test_signing_bridge.py

@@ -327,6 +327,63 @@ def test_key_resolution_request_rejects_api_key_metadata() -> None:
         KeyResolutionRequest(signer_id="owner-demo", metadata={"api_key": "must-not-cross-boundary"})
 
 
+@pytest.mark.parametrize(
+    "record",
+    [
+        lambda metadata: KeyResolutionRequest(
+            signer_id="owner-demo",
+            metadata=metadata,
+        ),
+        lambda metadata: KeyResolutionResult.from_mapping({
+            "status": "resolved",
+            "signer_id": "owner-demo",
+            "key_ref": "host-key://owner-demo/current",
+            "metadata": metadata,
+        }),
+        lambda metadata: TrustStoreDecision.from_mapping({
+            "status": "trusted",
+            "signer_id": "owner-demo",
+            "trust_anchor_ref": "host-trust://anchors/demo",
+            "metadata": metadata,
+        }),
+    ],
+)
+def test_trust_records_reject_forbidden_keys_inside_nested_collections(record) -> None:
+    with pytest.raises(GovApiError, match="forbidden_trust_material"):
+        record({"items": [{"nested": ({"password": "must-not-cross-boundary"},)}]})
+
+
+def test_trust_records_normalize_forbidden_key_spelling() -> None:
+    with pytest.raises(GovApiError, match="forbidden_trust_material"):
+        TrustStoreDecision.from_mapping({
+            "status": "trusted",
+            "signer_id": "owner-demo",
+            "trust_anchor_ref": "host-trust://anchors/demo",
+            "metadata": {"nested": {" PASSWORD ": "must-not-cross-boundary"}},
+        })
+
+
+def test_trust_metadata_uses_shared_json_depth_limit() -> None:
+    metadata = {}
+    cursor = metadata
+    for _ in range(34):
+        cursor["nested"] = {}
+        cursor = cursor["nested"]
+
+    with pytest.raises(GovApiError, match="json_boundary_max_depth"):
+        KeyResolutionRequest(signer_id="owner-demo", metadata=metadata)
+
+
+def test_trust_metadata_rejects_non_finite_numbers() -> None:
+    with pytest.raises(GovApiError, match="json_boundary_non_finite_number"):
+        KeyResolutionResult.from_mapping({
+            "status": "resolved",
+            "signer_id": "owner-demo",
+            "key_ref": "host-key://owner-demo/current",
+            "metadata": {"confidence": nan},
+        })
+
+
 def test_trust_store_decision_unknown_signer_is_not_trusted() -> None:
     decision = TrustStoreDecision.from_mapping({
         "status": "unknown",