fix(typescript): accept case-insensitive DID fingerprints in verifyPeer

[Dhinesh Ponnarasan (DhineshPonnarasan)]

Summary

Fix TypeScript peer verification to accept valid DID fingerprints regardless of hex letter casing while preserving existing fingerprint integrity checks.

Problem

DID fingerprint validation allowed uppercase and mixed-case hex, but the equality check compared against a lowercase digest value without normalizing the DID fingerprint. This could incorrectly reject valid identities when the DID used uppercase or mixed-case hex.

Changes

File	What changed
agent-governance-typescript/src/trust.ts	Normalized didFingerprint with toLowerCase() before comparing to the SHA-256 hex-derived expectedFingerprint.
agent-governance-typescript/tests/trust.test.ts	Added regression tests for lowercase/uppercase/mixed-case valid fingerprints and invalid fingerprint mismatch/malformed cases.

Testing

• cd agent-governance-typescript
• npm test -- trust.test.ts
• Result: 20 passed, 0 failed

---

closes #3374

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

No breaking changes detected.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

• verifyPeer() in agent-governance-typescript/src/trust.ts -- missing docstring
• README.md -- no updates found for the changes in verifyPeer() behavior
• CHANGELOG.md -- missing entry for the behavioral change in verifyPeer()

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

🤖 AI Agent: test-generator — `agent-governance-typescript/src/trust.ts`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

agent-governance-typescript/src/trust.ts

• verifyPeer_invalid_fingerprint_format -- Test for rejecting fingerprints with invalid formats (e.g., non-hexadecimal characters).
• verifyPeer_empty_fingerprint -- Test for rejecting empty or missing fingerprints.
• verifyPeer_null_fingerprint -- Test for rejecting null or undefined fingerprints.

agent-governance-typescript/tests/trust.test.ts

• verifyPeer_edge_case_fingerprint_length -- Test for fingerprints that are valid hex but have incorrect lengths (e.g., too short or too long).

[github-actions]

🤖 AI Agent: code-reviewer — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 0 warnings. The changes improve DID fingerprint validation and add comprehensive tests; no issues found.

#	Sev	Issue	Where

No issues found. Clean change.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[Imran Siddique (imran-siddique)]

Gentle nudge: this PR has been open without a code-owner review for more than 3 business days. MohammadHaroonAbuomar liamcrumm could one of you take a look when you have a moment? Thanks.

[MohammadHaroonAbuomar]

• agent-governance-typescript/src/trust.ts:162: prefer canonical-form rejection over comparison widening: generate() only emits lowercase fingerprints, and accepting case variants creates alias DIDs that pass verifyPeer while dodging registries/deny-lists/revocation keyed on the exact string (identity.ts:420,438). Drop the /i flag (reject non-canonical) or normalize at construction like .NET's NormalizeDid.
• DCO fails at head; cspell needs the PR's own test string nothex (or rename it).

Minor:

• adjacent pre-existing, tracking issues: TS verifyPeer is self-attesting (the .NET sibling hard-deprecated this); loadFromDisk swallows corrupt trust records and a forged future lastUpdate pins scores forever.

[MohammadHaroonAbuomar]

• agent-governance-typescript/src/trust.ts:162: prefer canonical-form rejection over comparison widening: generate() only emits lowercase fingerprints, and accepting case variants creates alias DIDs that pass verifyPeer while dodging registries/deny-lists/revocation keyed on the exact string (identity.ts:420,438). Drop the /i flag (reject non-canonical) or normalize at construction like .NET's NormalizeDid.
• DCO fails at head; cspell needs the PR's own test string nothex (or rename it).

Minor:

• adjacent pre-existing, tracking issues: TS verifyPeer is self-attesting (the .NET sibling hard-deprecated this); loadFromDisk swallows corrupt trust records and a forged future lastUpdate pins scores forever.

[MohammadHaroonAbuomar]

Several requests remain unaddressed for over a week, so I'm closing the PR. Feel free to reopen once they're addressed.