test: cover invalid delegation signature in action evidence

[joy7758]

Summary

Refs #36.

Adds the residual ACTION-path invalid-signature conformance case identified
after PR #37. This covers one remaining Issue #36 checklist item and does not
close the full issue.

What Changed

• Documents ACTION-008 as a MUST-level conformance case.
• Replaces the signed leaf credential with an otherwise identical credential
  whose signature differs by one byte while retaining valid hexadecimal shape
  and length.
• Verifies the Action Evidence path returns
  provenance_invalid / INVALID_CREDENTIAL before authorization or controller
  outcome handling.

Test Evidence

• New test: 1 passed
• ACTION and delegation selection: 16 passed
• Delegation and verifier unit tests: 21 passed
• Conformance suite: 31 passed
• Full suite: 252 passed, 3 hardware-fixture skips
• Coverage: 87.01%
• Ruff, mypy, Bandit, pip-audit, and git diff checks passed

A mutation check changed the expected classification to
authorization_invalid; the test failed because the actual classification
remained provenance_invalid.

Security and Compatibility

• Test and conformance documentation only.
• No runtime verifier or dependency changes.
• Uses synthetic credentials and makes no production-key, authorization,
  permission, or deployment-safety claim.
• Preserves the boundary between provenance failure, authorization failure,
  and valid negative outcome.

Remaining Issue #36 Checklist

This PR does not address:

• direct use of the public agent-manifest delegation verifier;
• credential validity-window fields;
• delegatee, session, or channel binding mismatch cases;
• longer ACTION-path attenuation and intermediate scope-widening cases;
• external subject identifier or digest representation.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	NONE
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b223ee41ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exercise competing downstream outcomes

The new case uses the permitted robot.move capability and the default accepted controller decision, so it only proves that an invalid signature is eventually classified as provenance-invalid. An implementation that performs authorization and controller handling before signature verification would still pass this MUST-level test, contrary to ACTION-008's stated ordering requirement. Add conflicting authorization-invalid and negative-controller inputs, or assert that those stages are not invoked.

Useful? React with 👍 / 👎.

[joy7758]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 0a1ffa6710

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[imran-siddique]

Reviewed the diff and read the thread (Codex found nothing on 0a1ffa6). Test and documentation only.

The part that makes this worth having is the ordering proof, not the tampered signature on its own. Asserting the two downstream classifications first (SCOPE_NOT_PERMITTED under the restrictive policy, CONTROLLER_REJECTED under the permissive one) and then showing both collapse to INVALID_CREDENTIAL once the leaf signature is flipped is what actually pins that provenance validation preempts authorization and outcome handling. A single-assertion version of this test would pass even if the ordering regressed.

The bit-flip via int(leaf.signature[:2], 16) ^ 1 keeps the signature well-formed hex, so this exercises signature verification rather than a parse failure. replace(leaf, ...) leaves the original chain intact for the control assertions in the same test.

One merge-order note: this and #80 both append to the same README table and the same tail of test_profile_conformance.py. Each is mergeable against main today, but the second one in will need a rebase.

Only failing check is the maintainer-hold gate.