Converge implementations on the draft-01 canonical encoding

[sunilp]

The Rust and Python reference implementations rejected each other's chained tokens in both directions whenever a delegation block was present. Reproduced before the fix:

• Rust mints, Python verifies: delegation block 1 does not grant right("tool:search")
• Python mints, Rust verifies: Check n°1 in block n°1: check if budget($b), $b <= 100

Each implementation matched the spec on one axis and neither on both. Rust emitted the canonical tool check but an inverted budget check; Python emitted the canonical budget direction but check if right(...) per scope, plus a block-source scan to compensate.

What this changes

Both now emit the canonical encoding from draft-prakash-aip-01 §3.4.1 and verify with the algorithm in §4.

• One self-contained check if per block. Scope narrowing follows from conjunction, so a widened block authorizes nothing.
• Budget is a budget_ceiling fact, not a check. A Datalog check cannot express "narrower than my parent": Python's verifier injected budget(0) making every such check vacuous, and Rust injected nothing so the check bound to the authority's ceiling and rejected valid chains.
• V4 structural attenuation walk at verification, covering scope, budget, expiry and principal invariance. Mint-time checks remain as a convenience to the delegator; an attacker appending a block does not run them.

Wildcards

tool:* worked in neither implementation. It compared literally, so a wildcard authority did not authorize tool:search. test_delegation_chain_three_hops used tool:* but only asserted depth and never authorized, so it never caught this.

Patterns now compile to starts_with clauses joined with or, under the Standard profile. The Simple profile keeps exact string equality exactly as draft-01 §3.4.1 prints it, so nothing here contradicts the published draft.

Security note

A block's scope constraint must be a single self-contained check, never a shared rule name. Rules do not attenuate: the authority block's rule stays in scope and is unioned with a delegation block's narrower rule of the same name, and the broader one then satisfies the delegation's own check. Verified against biscuit-auth before choosing the encoding, and now normative in spec/aip-tokens.md §7.2.

Why nothing caught this

The cross-language conformance tests at tests/conformance/ were outside CI's working-directory: python, CI only fired on aip-core-v* tags, and the tests skipped silently without biscuit-python. The Python to Rust test also used an authority-only token, so it would not have exercised delegation even if it ran.

All three now fixed: the tests exercise delegation in both directions, a new workflow runs them on push and pull request, and the job fails outright if biscuit-python is missing rather than skipping.

Verification

Python      131 passed
Rust         72 passed
Conformance   6 passed

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dc64e3ba-e468-4eb4-82db-4744a7fac68a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}