fix(agt-evidence-anchor): NFC-normalize agent_id/action_type/scope before hashing (#52)

mycelium_evidence_anchor.py's _compute_action_ref builds its own
domain-separated hash space (mycelium-evidence-anchor:v1: prefix) for
the community AGT EvidenceAnchor plugin, with agent_id/action_type/scope
taken from caller-supplied metadata. Unlike the canonical action_ref
profile (plugins/agt_evidence_anchor/action_ref.py), this path has no
ASCII-only Domain check, so two byte-different but visually identical
strings (NFC vs. NFD composition of the same value) hashed to two
different action_ref values for the same logical identity.

Flagged by Henri Sirkkavaara (SCITT list, 2026-08-16), raised as a
general NFC-vs-NFD-before-JCS point in an unrelated ARP/Certisyn
thread (Joel Hillier). Verified the canonical profile is unaffected:
action_ref.py's _validate_domain already rejects any non-ASCII value
in agent_id/action_type/scope with OutOfProfileDomainError before
hashing, which makes NFC/NFD divergence structurally impossible there
(the two forms only differ for non-ASCII code points). Added two
symmetric conformance vectors (nfc-001/nfc-002) confirming both forms
of the same identifier are rejected identically on the canonical path,
and documented the distinction between the two profiles in
docs/spec/action-ref.md.

No production adopters of this plugin (not in ADOPTERS.md/PROVIDERS.md,
not called from the main production path), no prior anchored data
affected -- this is the plugin's second commit since domain separation
was added (3710af2).

Changes:
- mycelium_evidence_anchor.py: unicodedata.normalize("NFC", ...) on the
  three text fields before building the preimage
- tests/test_mycelium_evidence_anchor.py: 3 new tests (NFC/NFD give the
  same action_ref for agent_id, scope, action_type)
- examples/conformance/action-ref-v1-domain-negative/*.fixture.json:
  nfc-001/nfc-002 vectors (canonical profile rejects both forms
  identically)
- docs/spec/action-ref.md: note explaining ASCII-only Domain closes
  this class of ambiguity by design for the canonical profile, and
  why the plugin needed the separate NFC fix

Verified: full suite green in a fresh clone of main (133 passed,
tests/ + plugins/agt_evidence_anchor/tests/), all 9 domain-negative
conformance vectors passed.

Author: giskard09

docs/spec/action-ref.md

@@ -2,6 +2,22 @@
 
 **Version:** 1.2 | **Published:** 2026-05-23 | **Updated:** 2026-06-03 (×2), 2026-07-29 (version negotiation, Domain enforcement) | **Stable ref (v1):** [`action-ref-v1.0`](https://github.com/giskard09/argentum-core/blob/action-ref-v1.0/docs/spec/action-ref.md) | **Stable ref (v2, domain separation):** [`action-ref-v2.0`](https://github.com/giskard09/argentum-core/blob/action-ref-v2.0/docs/spec/action-ref.md) | **Latest commit:** [96931c9](https://github.com/giskard09/argentum-core/commit/96931c9)
 
+**2026-08-16:** ASCII-only Domain enforcement (2026-07-29, above) closes Unicode
+normalization ambiguity (NFC vs. NFD) by design for this canonical profile — NFC and
+NFD only diverge on non-ASCII code points, and any non-ASCII value in `agent_id`,
+`action_type`, or `scope` is already rejected with `OUT_OF_PROFILE_DOMAIN` before
+hashing, so the two forms can never reach the preimage differently. This is an
+intentional consequence of the ASCII-only Domain, not a gap pending a fix — see the
+Domain paragraph below. Flagged for verification by Henri Sirkkavaara (SCITT list,
+2026-08-16, general NFC/NFD-before-JCS point raised in an unrelated ARP/Certisyn
+thread). Separately, the community plugin
+[`mycelium_evidence_anchor.py`](../../mycelium_evidence_anchor.py) computes its own
+domain-separated hash (`mycelium-evidence-anchor:v1:` prefix, distinct hash space, no
+production adopters) without this repo's ASCII-only Domain restriction — there,
+NFC/NFD divergence was a real gap, closed by normalizing `agent_id`/`action_type`/
+`scope` to NFC before hashing (unrelated to and does not change this canonical
+`action_ref` profile).
+
 **2026-07-30:** Tagged `action-ref-v2.0` — gate condition met, the two production
 adopters (SafeAgent/azender1, CTEF/kenneives) were briefed on the domain-separation
 gap by email the same day. v1 (bare 64-hex) is untouched and permanently valid; v2 is

examples/conformance/action-ref-v1-domain-negative/action-ref-v1-domain-negative.fixture.json

@@ -92,6 +92,30 @@
         "scope": "",
         "timestamp": "2026-05-24T10:30:00.000Z"
       }
+    },
+    {
+      "id": "nfc-001",
+      "description": "Unicode normalization symmetry check, prompted by Henri Sirkkavaara (SCITT list, 2026-08-16) raising NFC-vs-NFD-before-JCS ambiguity in an unrelated ARP/Certisyn thread. agent_id in NFC form: 'agent-café', precomposed U+00E9 (LATIN SMALL LETTER E WITH ACUTE). Non-ASCII, so the Domain paragraph rejects it -- same as its NFD twin below, confirming the ASCII-only profile closes NFC/NFD divergence by rejecting both forms identically rather than accepting one and not the other.",
+      "expect_valid": false,
+      "expect_error_field": "agent_id",
+      "preimage": {
+        "agent_id": "agent-café",
+        "action_type": "trail.anchor",
+        "scope": "mycelium:av-neg",
+        "timestamp": "2026-05-24T10:30:00.000Z"
+      }
+    },
+    {
+      "id": "nfc-002",
+      "description": "Same logical agent_id as nfc-001, NFD form: 'agent-café', base 'e' (U+0065) plus COMBINING ACUTE ACCENT (U+0301). Two code points, byte-different from nfc-001's single precomposed code point, but the same visible identifier. Must be rejected the same way (same field, same error) -- if this vector's outcome ever diverged from nfc-001's, NFC/NFD would silently produce two different treatments for one identity, exactly the gap this profile is designed to close.",
+      "expect_valid": false,
+      "expect_error_field": "agent_id",
+      "preimage": {
+        "agent_id": "agent-café",
+        "action_type": "trail.anchor",
+        "scope": "mycelium:av-neg",
+        "timestamp": "2026-05-24T10:30:00.000Z"
+      }
     }
   ]
 }

mycelium_evidence_anchor.py

@@ -20,6 +20,7 @@
 import hashlib
 import json
 import time
+import unicodedata
 from abc import ABC, abstractmethod
 from dataclasses import dataclass, field
 from enum import Enum
@@ -250,7 +251,7 @@ def _format_timestamp_rfc3339(timestamp_s: int) -> str:
 def _compute_action_ref(agent_id: str, action_type: str, scope: str, timestamp: int) -> str:
     """Domain-separated, JCS-canonicalized action_ref for this plugin's own hash space.
 
-    Two fixes over the prior implementation:
+    Three fixes over the prior implementation:
     (1) domain separation — "mycelium-evidence-anchor:v1:" prefix, so this plugin's
         hashes can never collide with the canonical action-ref.md preimage (a bare
         4-field JCS object with no prefix) or with any other protocol using the same
@@ -262,7 +263,20 @@ def _compute_action_ref(agent_id: str, action_type: str, scope: str, timestamp:
         an alias for the canonical action_ref — it does not touch or reuse action-ref.md's
         preimage, which has real production adopters (see ADOPTERS.md) and is not
         being changed here.
+    (3) Unicode normalization — agent_id/action_type/scope here come from caller-supplied
+        `metadata` with no ASCII-only Domain restriction (unlike action_ref.py's
+        `_validate_domain`, which rejects any non-ASCII value outright before hashing —
+        that makes NFC vs NFD moot on the canonical path). This plugin genuinely allows
+        non-ASCII values, so two byte-different but visually-identical strings (NFC vs
+        NFD composition of the same agent_id) would otherwise hash to two different
+        action_ref values for the same logical identity. Flagged by Henri Sirkkavaara
+        (SCITT list, 2026-08-16) against RFC 8785/JCS generally; this is the one site in
+        this repo where it was a live gap rather than already closed by the ASCII-only
+        Domain check. 2026-08-16.
     """
+    agent_id = unicodedata.normalize("NFC", agent_id)
+    action_type = unicodedata.normalize("NFC", action_type)
+    scope = unicodedata.normalize("NFC", scope)
     payload = {
         "agent_id": agent_id,
         "action_type": action_type,

tests/test_mycelium_evidence_anchor.py

@@ -1,6 +1,7 @@
 """Tests for MyceliumAnchor — EvidenceAnchor community plugin."""
 
 import hashlib
+import unicodedata
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -50,6 +51,38 @@ def test_hex_sha256(self):
         assert len(ref) == 64
         int(ref, 16)  # must be valid hex
 
+    # NFC vs NFD: precomposed accented char (single code point) vs base char
+    # + combining mark (two code points) — visually identical, byte-different.
+    # Built via unicodedata.normalize rather than relying on a source-literal
+    # glyph, since editors/tooling commonly normalize typed unicode to NFC on
+    # save, which would silently defeat the "these are really different
+    # bytes" premise the test depends on.
+    _RAW_ACCENTED = "café"  # "café", NFC form (single U+00E9)
+
+    def test_nfc_nfd_agent_id_same_ref(self):
+        nfc = unicodedata.normalize("NFC", self._RAW_ACCENTED)
+        nfd = unicodedata.normalize("NFD", self._RAW_ACCENTED)
+        assert nfc != nfd  # sanity: the two forms really are different bytes
+        a = _compute_action_ref(f"agent-{nfc}", "agt:evidence_anchor", "agt-evidence", 1000)
+        b = _compute_action_ref(f"agent-{nfd}", "agt:evidence_anchor", "agt-evidence", 1000)
+        assert a == b
+
+    def test_nfc_nfd_scope_same_ref(self):
+        nfc = unicodedata.normalize("NFC", self._RAW_ACCENTED)
+        nfd = unicodedata.normalize("NFD", self._RAW_ACCENTED)
+        assert nfc != nfd
+        a = _compute_action_ref("agent-1", "agt:evidence_anchor", f"scope-{nfc}", 1000)
+        b = _compute_action_ref("agent-1", "agt:evidence_anchor", f"scope-{nfd}", 1000)
+        assert a == b
+
+    def test_nfc_nfd_action_type_same_ref(self):
+        nfc = unicodedata.normalize("NFC", self._RAW_ACCENTED)
+        nfd = unicodedata.normalize("NFD", self._RAW_ACCENTED)
+        assert nfc != nfd
+        a = _compute_action_ref("agent-1", f"op-{nfc}", "agt-evidence", 1000)
+        b = _compute_action_ref("agent-1", f"op-{nfd}", "agt-evidence", 1000)
+        assert a == b
+
 
 # ---------------------------------------------------------------------------