spec(security): pin sf-binary encoding + tighten URL canonicalization (#2341, #2343)

[bokelley]

Summary

Two clarifications to the AdCP RFC 9421 request-signing profile surfaced by TypeScript reference SDK work (adcp-client#575) and follow-up expert review. Both are spec tightenings — no behavioral change for signers that already match the reference vectors.

#2341 — binary value encoding

• Signature and Content-Digest sf-binary tokens are normatively base64url-no-padding (RFC 4648 §5), overriding RFC 8941 §3.3.5's standard-base64 default. Matches the existing nonce rule; avoids two proxy hazards (/ rewriting, = parsed as a structured-field delimiter).
• Verifiers MUST reject mixed-alphabet tokens (any of [+/=] plus any of [-_] in one value) — mixed tokens can decode to different bytes depending on "translate-then-decode" order, letting an attacker stage a Content-Digest mismatch that one verifier accepts and another rejects.
• Verifiers MAY lenient-decode pure standard-base64 through AdCP 3.2 (time-bounded compatibility affordance).

#2343 — URL canonicalization

Expanded the @target-uri algorithm with normative text for every case that previously admitted implementation variance:

• UTS-46 Nontransitional pinned (CheckHyphens/CheckBidi/UseSTD3ASCIIRules=true, Transitional_Processing=false) for IDN → Punycode. Closes the single biggest silent divergence between TS (url.domainToASCII), Go (x/net/idna), and Python (idna package).
• IPv6 zone identifiers rejected (RFC 6874 §1 — node-local, no meaning cross-host). Signers MUST NOT sign, verifiers MUST reject.
• Consecutive slashes preserved byte-for-byte (was: collapsed). Closes the /admin//foo vs /admin/foo path-confusion surface. Deployments MUST disable slash-folding on signed routes.
• @authority derived from wire Host (or HTTP/2+ :authority), MUST byte-for-byte match canonical @target-uri authority. Closes cross-vhost replay on shared verifier pools.
• Malformed-authority rejection expanded: bracket-mismatch IPv6, bare IPv6, empty authority, userinfo-only, raw non-ASCII host.
• Percent-encoding spelled out: reserved stays encoded (%3A), full unreserved set decoded (%41 → A, not just %7E → ~).
• Combined dot-segment + consecutive-slash cases pinned (/a/.//b → /a//b, /a//../b → /a/b).

New conformance set

static/compliance/source/test-vectors/request-signing/canonicalization.json — 31 fixed input/output cases (25 positive, 6 malformed-reject) covering every algorithm step. Version-pinned ("version": "3.0"). Independent of crypto — SDKs run it as a fast unit test. Published at /compliance/{version}/test-vectors/request-signing/canonicalization.json.

Closes #2341, #2343. Original profile: #2323 (3.0 GA).

Test plan

• npm run precommit passes (29 test files, 587 tests, typecheck clean)
• Mintlify docs validation passes
• canonicalization.json parses, version-pinned, no duplicate input_urls, all required fields present on every case
• Punycode output for bücher.example independently verified via Node's url.domainToASCII
• TypeScript SDK (adcp-client#575) runs the 31 cases after this merges
• Go and Python reference SDKs wire up canonicalization.json as a unit-test suite

🤖 Generated with Claude Code

[github-actions]

Schema Link Check Results

Commit: c7883d8 - spec(security): rename URL-malformed error code to request_target_uri_malformed

⚠️ Warnings (schema not yet released)

These schemas exist in source but haven't been released yet. The links will be broken until the next version is published:

• https://adcontextprotocol.org/schemas/v3/enums/specialism.json
  • Schema exists in latest (source) but not yet released in v3
  • Action: This link will work after next 3.x release is published

---

To fix: Either:

1. Wait for the next release and merge this PR after the release is published
2. Use latest instead of a version alias if you need the link to work immediately (note: latest is the development version and may change)
3. Coordinate with maintainers to cut a new release before merging