fix: hold the last three entry points to the type they document

[lywinged]

Completes what #6 began and deliberately deferred. That change guarded sign.verify_record and sign.jwk_thumbprint and left four functions of the same class alone, because open upstream PRs agentrust-io#225 and agentrust-io#227 were editing them and carrying the fix here would have collided with work someone else was mid-way through.

Those PRs have landed. Re-running the same sweep against the merged tree shows what they closed and what they did not:

	before	after agentrust-io#225/agentrust-io#227/agentrust-io#229	after this
provenance.tool_catalog_hash	4 of 12	0 (closed by agentrust-io#229)	0
provenance.verify_record	11 of 12	11	0
provenance.check_tool_catalog	11 of 12	11	0
content_marking.verify_assertion	2nd arg	unguarded	0

agentrust-io#225 added _as_object for record["identity"] and record["tool_catalog"]. Neither field is reachable until the record itself is a mapping, so a guard on a field inside a record cannot close the record's own type. #6's body said that as a prediction; it is now a measurement.

AttributeError is not the ProvenanceError that verify_record documents, so it passes straight through a caller's except ProvenanceError.

The one that is worse than a crash

content_marking.verify_assertion never checked that record_bytes were bytes. bytes(5) is b"\x00\x00\x00\x00\x00", so an int was hashed, failed to match, and the caller was told:

the record at https://example.com/r.json does not match the assertion: computed sha256:8855508a... The record changed after the asset was signed, or the URL is serving a different one.

Nothing was wrong with the record or the URL. A crash says the call was wrong. This said somebody else's server was serving different evidence, specifically, confidently, with a digest attached. build_assertion has guarded the same argument all along.

test_an_int_no_longer_reports_a_record_mismatch asserts the absence of that diagnosis by name, so it cannot come back quietly.

After this

Every public entry point in the package reports zero leaks under the sweep:

sign.verify_record                0    provenance.verify_record          0
sign.jwk_thumbprint               0    provenance.check_tool_catalog     0
validate.validate_json            0    provenance.tool_catalog_hash      0
validate.iter_errors              0    content_marking.verify_assertion  0
intent_bridge.digest_jcs          0    intent_bridge.sign_bridge         0

sign.sign_record and provenance.sign_record still answer TypeError to a non-mapping. They are producers rather than verifiers, document no error contract, and TypeError is Python's own answer to that call. #6 left them and so does this.

A changelog sentence, fixed because it is in the entry above the one I added

The em dash sweep in agentrust-io#230 removed the punctuation from the entry agentrust-io#227 merged and left:

Valid JSON is not always an object that is an array, a string, a number, null, and a bool are all valid top-level JSON␣␣and record_bytes is ...

"an object that is an array" states the opposite of the point, and there is a leftover double space where the second dash was. tools/check_dashes.py cannot catch this: the removal was clean and the sentence is what broke.

Checks

Thirty-two tests, each shown load-bearing by removing the guard it covers:

guard removed	failures
verify_assertion record_bytes	12
provenance.verify_record record	11
provenance.check_tool_catalog record	10

1031 passed, 1 skipped. Ruff clean. tools/check_dashes.py reports nothing in any file this repository shares with upstream.

This branch also carries a merge of upstream main (five commits: agentrust-io#225, agentrust-io#227, agentrust-io#228, agentrust-io#229, agentrust-io#230). The conflicts were in four files and all but CHANGELOG.md were pure em dash removal; those were resolved by taking this fork's content and adopting upstream's own punctuation choice for each identical sentence rather than inventing one. CHANGELOG.md was an additive merge of both sides' entries.

---

Generated by Claude Code

[github-actions]

❔ Contributor Check: UNKNOWN

Check	Result
Profile	UNKNOWN
Credential	LOW
Overall	UNKNOWN

Automated check by AgenTrust Contributor Check.