.NET/TS trust: verifyPeer rejects uppercase DID fingerprint despite case-insensitive format check

[DhineshPonnarasan]

Summary

TrustManager.verifyPeer accepts uppercase hexadecimal DID fingerprints at format-validation time, but then compares the fingerprint to a lowercase digest using a case-sensitive string comparison.

This rejects an otherwise valid fingerprint value that differs only by hex letter casing.

Reproduction (public API)

1. Generate an identity with AgentIdentity.generate("peer-agent").
2. Export with exportJSON() and replace the DID fingerprint suffix with its uppercase form.
3. Re-import via AgentIdentity.fromJSON(...).
4. Call TrustManager.verifyPeer("peer-agent", identity).

Observed result:

• verified === false
• reason === "Peer identity DID fingerprint does not match the public key"

Additional check in the same repro:

• uppercaseFingerprint.toLowerCase() === expectedFingerprint.toLowerCase() is true.

Expected behavior

If fingerprint format validation accepts uppercase hex, verification should not fail when the value differs only by case.

Actual behavior

Verification fails due to case-sensitive comparison.

Implementation evidence

In agent-governance-typescript/src/trust.ts:

• format check uses /^[0-9a-f]{16}$/i (case-insensitive)
• comparison uses didFingerprint !== expectedFingerprint (case-sensitive)

Suggested fix

Normalize both values before comparison (for example, compare ToLowerInvariant() / .toLowerCase() values) so the comparison matches the accepted hex format semantics.

Environment

• Repository: microsoft/agent-governance-toolkit
• Branch: main
• Commit verified: e5693cb11db5e336508ee0a793356ccfb84c1834
• Platform used for repro: Windows

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.