Reject noncanonical padded base64url signatures for interoperability

[vaibhav0xq]

Summary

At pinned commit 3cc03a6, technocore_agent.py decodes signatures with base64.urlsafe_b64decode(signature + "==") before Ed25519 verification. An already padded signature is therefore decoded and accepted without first enforcing the canonical 86-character unpadded base64url form.

This is a bounded compatibility divergence, not a claim that the protocol is broadly broken.

Minimal reproducing vector

• Seed: padded-base64url-contribution-2026-08-25
• DID: did:key:z6MktNvQh9uSK3Hwxh2c9iCQZs3Q3kgXWhNEhcP4n7fvQWdr
• Room: gauntlet
• Nonce: 9007199254740993001
• Text: hello
• Signature: 7x4LHPXWJBlqBIP614Rx0PNkdmWrkfjTSYmqLZ9EK0IJFdZbZZ43bpnNl7-D0Dychqlzko2Z7oToqIjvj-O7CQ==

The vector takes the valid 86-character signature and appends ==.

Observed in a fresh Gauntlet run:

• TypeScript reference adapter: rejected the padded signature
• Official Python v0.9.1 oracle: rejected the padded signature
• zunmax adapter pinned at 3cc03a6: accepted the padded signature

Practical impact

A say-signed URL containing a padded signature can verify here but fail in stricter implementations. Signers should emit canonical unpadded base64url. Verifiers that want interoperable protocol behavior should reject noncanonical padding before cryptographic verification.

Reproducer and signed record

• Reproducer: https://github.com/vaibhav0xq/technocore-gauntlet#a-real-divergence-found-by-the-suite
• Public receipt: https://github.com/vaibhav0xq/technocore-gauntlet/blob/main/evidence/technocore-receipts.json
• Technocore record: room technocore, sequence 86385

[vaibhav0xq]

The reproducing evidence is now a single committed file rather than a README anchor.

Exported run bundle: https://github.com/vaibhav0xq/technocore-gauntlet/blob/827608a37858f4d662fac6e87255a26f53ba6704/evidence/run-padded-base64url-2026-08-25.json

Seed padded-base64url-contribution-2026-08-25, 45 cases, three implementations. The three strict-signature-encoding cases record the divergence directly:

• technocore-ts-reference-local: {"valid": false}
• technocore-python-official-0.9.1: {"valid": false}
• zunmax-did-starter-3cc03a6: {"valid": true}

Reading that file needs no install, database or API.

The signed public record of the finding, verifiable offline with a zero-dependency checker in the same repository: https://github.com/vaibhav0xq/technocore-gauntlet/blob/827608a37858f4d662fac6e87255a26f53ba6704/evidence/technocore-receipts.json