lane 4A follow-up: classify non-dict input as unsupported, not legacy

Caught during a second adversarial sweep of the kernel adapter: the
``verify_commitment`` wrapper was coercing non-dict input to an empty dict
before handing it to the kernel. The kernel's empty-dict branch treats
``{}`` as a legacy envelope (missing ``spec_version``), so non-dict input
(``None``, lists, strings, scalars) was producing a result with
``spec_version_status="legacy"`` and ``legacy_envelope=True`` — labels that
read as "valid pre-spec_version envelope that failed signature" when the
truth is "this isn't a valid envelope shape at all."

``overall=False`` was correct in every case (the safety-relevant
guarantee), so this was a cosmetic, not a correctness, issue. But the
labels appear in CLI panels, logs, and audit-export JSON, so consistency
matters.

Two changes:

- Pass the envelope through to the kernel unchanged — the kernel handles
  non-dict directly (returns ``legacy_envelope=False`` with errors
  ``["envelope is not a JSON object"]``), so the coercion was the bug.
- Fix the ``spec_version_status`` synth: non-dict input is ``unsupported``,
  with ``reason="envelope_not_a_json_object"`` for diagnostics. The
  trichotomy stays (``supported`` / ``legacy`` / ``unsupported``); only
  malformed input gets the precise diagnostic ``reason``.

Parametrized regression test covers five non-dict shapes (None / [] /
"hello" / 42 / True). The pre-kernel in-tree code crashed with
``AttributeError`` on the same inputs, so this also locks in the soft-fail
improvement from the kernel migration.

Suite: 229 passed, 21 skipped. Cross-product green
(``TestCrossProductVerify`` + ``cross-product-verified-model`` E2E).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: vilenarios

ario_mlflow/proof.py

@@ -216,18 +216,30 @@ def verify_commitment(
         """
         # ``allow_legacy=True`` preserves the historical behavior of accepting
         # envelopes anchored before ``spec_version`` shipped (the only mlflow
-        # envelopes on Arweave that lack the field).
+        # envelopes on Arweave that lack the field). The kernel handles
+        # non-dict input directly (returns a fully-failed VerificationResult
+        # with ``legacy_envelope=False``), so pass it through unchanged
+        # instead of coercing — coercing non-dict → ``{}`` would land in the
+        # kernel's empty-dict-is-legacy branch and produce ``legacy_envelope
+        # =True``, which misclassifies malformed input as a legacy envelope.
         result = _kernel_verify_envelope(
-            envelope if isinstance(envelope, dict) else {},
+            envelope,
             payload_bytes=payload_bytes,
             allow_legacy=True,
         )
 
+        is_dict = isinstance(envelope, dict)
+        spec_version = envelope.get("spec_version") if is_dict else None
+
         # Synthesize the trichotomy from the kernel's binary signal + legacy
         # flag. ``spec_version_status`` is part of the mlflow result contract;
         # callers (verify_signature, tests, the CLI report) branch on it.
-        spec_version = (envelope or {}).get("spec_version") if isinstance(envelope, dict) else None
-        if spec_version is None:
+        # Non-dict input is malformed, not legacy: label it ``unsupported``
+        # so the result reads coherently (e.g. ``spec_status=="unsupported"``
+        # never appears alongside ``legacy_envelope=True``).
+        if not is_dict:
+            spec_status = "unsupported"
+        elif spec_version is None:
             spec_status = "legacy"
         elif result.spec_version_ok:
             spec_status = "supported"
@@ -240,11 +252,11 @@ def verify_commitment(
             "signature_valid": result.signature_ok,
             "payload_hash_valid": result.payload_hash_ok,
             "computed_payload_hash": computed,
-            "stored_payload_hash": (envelope or {}).get("payload_hash") if isinstance(envelope, dict) else None,
+            "stored_payload_hash": envelope.get("payload_hash") if is_dict else None,
             "spec_version_status": spec_status,
             "legacy_envelope": result.legacy_envelope,
             "overall": result.ok,
         }
         if spec_status == "unsupported":
-            out["reason"] = "unsupported_spec_version"
+            out["reason"] = "unsupported_spec_version" if is_dict else "envelope_not_a_json_object"
         return out

tests/test_plugin_smoke.py

@@ -269,6 +269,29 @@ def test_verify_commitment_ignores_underscore_prefixed_caller_annotations(tmp_pa
     assert engine.verify_commitment(env_tampered)["signature_valid"] is False
 
 
+@pytest.mark.parametrize("malformed", [None, [], "hello", 42, True])
+def test_verify_commitment_classifies_non_dict_as_unsupported(tmp_path, malformed):
+    """Adversarial / malformed input (non-dict) must classify cleanly.
+
+    ``overall=False`` is the safety-relevant guarantee, but the label
+    fields should also read coherently: a non-dict input is malformed,
+    not legacy. ``spec_version_status="unsupported"`` and
+    ``legacy_envelope=False`` together describe "this isn't a valid
+    envelope shape," with ``reason="envelope_not_a_json_object"``
+    surfaced for diagnostics. The pre-kernel in-tree code crashed with
+    ``AttributeError`` on non-dict input; the kernel-backed adapter
+    soft-fails uniformly.
+    """
+    engine = ProofEngine(str(tmp_path / "priv"), str(tmp_path / "pub"))
+    result = engine.verify_commitment(malformed)
+
+    assert result["overall"] is False
+    assert result["signature_valid"] is False
+    assert result["spec_version_status"] == "unsupported"
+    assert result["legacy_envelope"] is False
+    assert result.get("reason") == "envelope_not_a_json_object"
+
+
 def test_create_commitment_event_id_and_signed_at_overrides(tmp_path):
     """Caller may provide event_id / signed_at for deterministic tests."""
     engine = ProofEngine(str(tmp_path / "priv"), str(tmp_path / "pub"))