lane 4A follow-up #2: classify non-dict verify_commitment input as unsupported (not legacy) (#22)

* lane 4A follow-up: classify non-dict input as unsupported, not legacy

Caught during a second adversarial sweep of the kernel adapter: the
``verify_commitment`` wrapper was coercing non-dict input to an empty dict
before handing it to the kernel. The kernel's empty-dict branch treats
``{}`` as a legacy envelope (missing ``spec_version``), so non-dict input
(``None``, lists, strings, scalars) was producing a result with
``spec_version_status="legacy"`` and ``legacy_envelope=True`` — labels that
read as "valid pre-spec_version envelope that failed signature" when the
truth is "this isn't a valid envelope shape at all."

``overall=False`` was correct in every case (the safety-relevant
guarantee), so this was a cosmetic, not a correctness, issue. But the
labels appear in CLI panels, logs, and audit-export JSON, so consistency
matters.

Two changes:

- Pass the envelope through to the kernel unchanged — the kernel handles
  non-dict directly (returns ``legacy_envelope=False`` with errors
  ``["envelope is not a JSON object"]``), so the coercion was the bug.
- Fix the ``spec_version_status`` synth: non-dict input is ``unsupported``,
  with ``reason="envelope_not_a_json_object"`` for diagnostics. The
  trichotomy stays (``supported`` / ``legacy`` / ``unsupported``); only
  malformed input gets the precise diagnostic ``reason``.

Parametrized regression test covers five non-dict shapes (None / [] /
"hello" / 42 / True). The pre-kernel in-tree code crashed with
``AttributeError`` on the same inputs, so this also locks in the soft-fail
improvement from the kernel migration.

Suite: 229 passed, 21 skipped. Cross-product green
(``TestCrossProductVerify`` + ``cross-product-verified-model`` E2E).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* verify_signature: propagate verify_commitment's precise reason field

Knock-on of the malformed-input label cleanup: ``verify_signature`` was
hardcoding ``reason="unsupported_spec_version"`` whenever ``spec_status``
came back as ``"unsupported"``, which now overwrites the more specific
``"envelope_not_a_json_object"`` diagnostic that ``verify_commitment``
emits for non-dict input. The fix is a one-line change — fall back to
the generic reason only when ``verify_commitment`` didn't supply one.

Regression test pins ``verify_signature(None, engine)["reason"]``.

Suite: 230 passed, 21 skipped.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: vilenarios

ario_mlflow/proof.py

@@ -216,18 +216,30 @@ def verify_commitment(
         """
         # ``allow_legacy=True`` preserves the historical behavior of accepting
         # envelopes anchored before ``spec_version`` shipped (the only mlflow
-        # envelopes on Arweave that lack the field).
+        # envelopes on Arweave that lack the field). The kernel handles
+        # non-dict input directly (returns a fully-failed VerificationResult
+        # with ``legacy_envelope=False``), so pass it through unchanged
+        # instead of coercing — coercing non-dict → ``{}`` would land in the
+        # kernel's empty-dict-is-legacy branch and produce ``legacy_envelope
+        # =True``, which misclassifies malformed input as a legacy envelope.
         result = _kernel_verify_envelope(
-            envelope if isinstance(envelope, dict) else {},
+            envelope,
             payload_bytes=payload_bytes,
             allow_legacy=True,
         )
 
+        is_dict = isinstance(envelope, dict)
+        spec_version = envelope.get("spec_version") if is_dict else None
+
         # Synthesize the trichotomy from the kernel's binary signal + legacy
         # flag. ``spec_version_status`` is part of the mlflow result contract;
         # callers (verify_signature, tests, the CLI report) branch on it.
-        spec_version = (envelope or {}).get("spec_version") if isinstance(envelope, dict) else None
-        if spec_version is None:
+        # Non-dict input is malformed, not legacy: label it ``unsupported``
+        # so the result reads coherently (e.g. ``spec_status=="unsupported"``
+        # never appears alongside ``legacy_envelope=True``).
+        if not is_dict:
+            spec_status = "unsupported"
+        elif spec_version is None:
             spec_status = "legacy"
         elif result.spec_version_ok:
             spec_status = "supported"
@@ -240,11 +252,11 @@ def verify_commitment(
             "signature_valid": result.signature_ok,
             "payload_hash_valid": result.payload_hash_ok,
             "computed_payload_hash": computed,
-            "stored_payload_hash": (envelope or {}).get("payload_hash") if isinstance(envelope, dict) else None,
+            "stored_payload_hash": envelope.get("payload_hash") if is_dict else None,
             "spec_version_status": spec_status,
             "legacy_envelope": result.legacy_envelope,
             "overall": result.ok,
         }
         if spec_status == "unsupported":
-            out["reason"] = "unsupported_spec_version"
+            out["reason"] = "unsupported_spec_version" if is_dict else "envelope_not_a_json_object"
         return out

ario_mlflow/verify.py

@@ -479,7 +479,11 @@ def verify_signature(envelope: dict, proof_engine: ProofEngine) -> dict:
         "legacy_envelope": legacy,
     }
     if spec_status == "unsupported":
-        out["reason"] = "unsupported_spec_version"
+        # Propagate the more precise diagnostic from verify_commitment when
+        # available (e.g. ``envelope_not_a_json_object`` for malformed input);
+        # fall back to the generic ``unsupported_spec_version`` when the
+        # envelope had a real-but-unknown spec major.
+        out["reason"] = result.get("reason", "unsupported_spec_version")
     return out
 
 

tests/test_plugin_smoke.py

@@ -269,6 +269,29 @@ def test_verify_commitment_ignores_underscore_prefixed_caller_annotations(tmp_pa
     assert engine.verify_commitment(env_tampered)["signature_valid"] is False
 
 
+@pytest.mark.parametrize("malformed", [None, [], "hello", 42, True])
+def test_verify_commitment_classifies_non_dict_as_unsupported(tmp_path, malformed):
+    """Adversarial / malformed input (non-dict) must classify cleanly.
+
+    ``overall=False`` is the safety-relevant guarantee, but the label
+    fields should also read coherently: a non-dict input is malformed,
+    not legacy. ``spec_version_status="unsupported"`` and
+    ``legacy_envelope=False`` together describe "this isn't a valid
+    envelope shape," with ``reason="envelope_not_a_json_object"``
+    surfaced for diagnostics. The pre-kernel in-tree code crashed with
+    ``AttributeError`` on non-dict input; the kernel-backed adapter
+    soft-fails uniformly.
+    """
+    engine = ProofEngine(str(tmp_path / "priv"), str(tmp_path / "pub"))
+    result = engine.verify_commitment(malformed)
+
+    assert result["overall"] is False
+    assert result["signature_valid"] is False
+    assert result["spec_version_status"] == "unsupported"
+    assert result["legacy_envelope"] is False
+    assert result.get("reason") == "envelope_not_a_json_object"
+
+
 def test_create_commitment_event_id_and_signed_at_overrides(tmp_path):
     """Caller may provide event_id / signed_at for deterministic tests."""
     engine = ProofEngine(str(tmp_path / "priv"), str(tmp_path / "pub"))
@@ -419,6 +442,23 @@ def test_verify_signature_wrapper_surfaces_spec_version_state(tmp_path):
     assert out["reason"] == "unsupported_spec_version"
 
 
+def test_verify_signature_surfaces_specific_reason_for_non_dict_input(tmp_path):
+    """``verify_signature`` should pass the precise diagnostic from
+    ``verify_commitment`` through (``envelope_not_a_json_object`` for
+    malformed input) rather than always overwriting with the generic
+    ``unsupported_spec_version``. ``ok=False`` is the safety guarantee;
+    the precise ``reason`` is for diagnostics."""
+    from ario_mlflow.verify import verify_signature
+
+    engine = ProofEngine(str(tmp_path / "priv"), str(tmp_path / "pub"))
+    out = verify_signature(None, engine)
+    assert out["ok"] is False
+    assert out["signature_valid"] is False
+    assert out["spec_version_status"] == "unsupported"
+    assert out["legacy_envelope"] is False
+    assert out["reason"] == "envelope_not_a_json_object"
+
+
 def test_verify_commitment_rejects_underscore_injection_on_agent_envelope(tmp_path):
     """Profile-conditional ``_*`` strip: only mlflow envelopes are lenient.