[pomazanbohdan]

Motivation

• Close a security gap in precursor fingerprint canonicalization where attacker-padded JSON objects could omit required receipt fields and be canonicalized with null values, weakening receipt identity checks.
• Preserve legacy compatibility by allowing only the documented omission of policy_bundle_ref (which should canonicalize to null) while rejecting any other missing or unknown keys.

Description

• Hardened canonical_precursor_receipt in crates/taskflow-host-bridge/src/receipt_binding.rs to reject unknown keys and require all HOST_BRIDGE_PRECURSOR_RECEIPT_FIELDS to be present except for the legacy policy_bundle_ref case.
• Replaced the permissive object.get(...).cloned().unwrap_or(Value::Null) behavior with explicit presence checks that return host_bridge_precursor_fingerprint_missing for missing required fields while canonicalizing a missing policy_bundle_ref to null.
• Added focused unit tests precursor_fingerprint_rejects_padded_missing_required_fields and precursor_fingerprint_allows_only_legacy_missing_policy_bundle_ref to cover the padded-omission exploit and the legacy omission compatibility.
• Changes are narrowly scoped to crates/taskflow-host-bridge/src/receipt_binding.rs and the added tests in its tests module.

Testing

• Ran cargo test -p taskflow-host-bridge and the package test suite passed (including receipt-binding tests); focused new tests passed.
• Executed cargo test -p taskflow-host-bridge receipt_binding::tests -- --nocapture to verify the receipt-binding unit tests — all passed.
• Ran the public API check test (tests/precursor_fingerprint_public_api.rs) and it passed.
• Ran cargo fmt -p taskflow-host-bridge -- --check and git diff --check as hygiene checks; both succeeded.

---

Codex Task