[Benoît Cortier (CBenoit)]

Metadata values exclude invisible format characters so that no value can reorder or hide text where an administrator reads it. The list still let through code points that render invisibly without being format controls, such as the Hangul fillers, the combining grapheme joiner and the variation selectors, so a host name could still hide text.

The Agent Identity contract now lists every Unicode default-ignorable code point, reserved ones included so that a character assigned there later is covered, plus the interlinear annotation characters U+FFF9–U+FFFB: U+00AD, U+034F, U+061C, U+115F–U+1160, U+17B4–U+17B5, U+180B–U+180F, U+200B–U+200F, U+202A–U+202E, U+2060–U+206F, U+3164, U+FE00–U+FE0F, U+FEFF, U+FFA0, U+FFF0–U+FFFB, U+1BCA0–U+1BCA3, U+1D173–U+1D17A, U+E0000–U+E0FFF. It stays a closed list of code points, so that the agent and every authority agree whatever Unicode version their runtimes ship.

• The agent strips the listed code points from every metadata value before truncating it, and sends the Linux /etc/machine-id as-is instead of trimming it.
• The authority library (version 2026.10.28.1) and the mock authority refuse a value holding one with invalid_request.
• The conformance suite checks every range at both ends and inside, and accepts the code points next to each range.
• The conformance agent check compares machine_id only when the host provides a value, so an agent on a Linux host whose /etc/machine-id is empty or missing, which omits the key, now passes.

DVLS gets the extended list with the next authority library package; until it takes that package, its conformance run fails the new refusal checks.

Issue: DGW-478
Issue: DGW-479
Security: yes

🤖 Generated with Claude Code

[Benoît Cortier (CBenoit)]

Evidence

Range on top of #2166's head 3e51fb6a5; this PR's own diff is 3e51fb6a5..HEAD until #2166 merges and the branch is rebased.

Lines changed (3e51fb6a5..HEAD)

Kind	Files	+ / −
Production	crates/agent-identity/src/metadata.rs (list, machine ID; file also holds its unit tests), dotnet/.../Bodies/AgentMetadata.cs, .csproj version	60 / 36 (incl. those inline tests)
Mock authority (test infrastructure, list and unit tests)	crates/agent-identity-mock/src/name_eval.rs	25 / 15
Tests	conformance agent.rs, client.rs, protocol.rs; AgentMetadataTests.cs	460 / 122
Docs	CONTRACT.agent-identity.md (one line, approved wording), COVERAGE.md	6 / 4

Checks (Windows, this worktree's own target directory)

• The §3 list was checked against Unicode 18.0 DerivedCoreProperties.txt Default_Ignorable_Code_Point; the contract, mock, agent, .NET library and conformance suite hold the same 17 ranges (compared range by range).
• cargo fmt --check; cargo clippy -p agent-identity -p agent-identity-mock -p agent-identity-conformance --all-targets -- -D warnings: clean.
• cargo test -p agent-identity -p agent-identity-mock -p agent-identity-conformance: 195, 513 + 10, 59 passed (1 ignored).
• Conformance through cargo test -p testsuite --test integration_tests agent_identity::conformance: 136 PASS, 0 FAIL, 55 SKIP (Windows software provider keys need an elevated run), 4 N/A, including p_metadata_invisible_format_characters, p_channel_hello_invalid_metadata_rejected and p_friendly_name_white_space_and_truncation. Linux CI covers the file key backend and the /etc/machine-id path.
• Red runs: against the mock and agent of fix(agent): refuse invisible format characters in metadata #2166, p_metadata_invisible_format_characters, p_channel_hello_invalid_metadata_rejected and (file key backend) a_metadata_invisible_format_characters_removed failed on newly listed code points; the moved white-space case passed.
• .NET: build.ps1 0 warnings, 0 errors; dotnet test 1882 passed.
• ci/check-oracle-markers.ps1 -Base origin/master: exit 0 (a later local rerun hit the unauthenticated GitHub API rate limit).

Review

Routine rounds on the implementations and on the suite changes (the suite reviewed blind to the implementations), then a final whole-delta round with an intent-drift audit (all touched statements conform), then a fresh round on the post-final fixes. Nothing blocking remains.

Not taken:

• No property test over the long allowed runs between ranges: a wrongly added range inside one is unlikely, and the suite's neighbour checks catch the common off-by-one.
• The accepted neighbour U+DFFFF is a noncharacter; §3's list is closed and noncharacters are valid scalar values, so an authority refusing it deviates from §3. Watch for it in the DVLS run.
• When the suite cannot read /etc/machine-id for a reason other than its absence, it skips the machine_id comparison without marking the run incomplete: no test is skipped, and a world-readable file that cannot be read is a host anomaly.

Deviations

• The Linux machine ID read now sends the file as-is (no trim), which the conformance check pins; this goes beyond the two gaps but keeps the agent and suite agreeing with §3.1.

Note

LLM-assisted content (no human feedback).

[Benoît Cortier (CBenoit)]

UNTESTED: properties

• crates/agent-identity/src/metadata.rs, Linux machine_id(): the agent sends /etc/machine-id as-is and must not trim it. Trimming and the control-character removal agree on every normal host, so no test sees a reintroduced trim; the conformance suite notices only on a host whose file has surrounding spaces.

Note

LLM-assisted content (no human feedback).