fix(rest/python): verify request signatures per RFC 9421 instead of accepting everything#122

Open

vishkaty wants to merge 8 commits into

Universal-Commerce-Protocol:mainfrom

vishkaty:feat/rfc9421-signatures

Commits on Jul 23, 2026

feat(python/server): add RFC 9421 signature module with RFC test vectors
katyalai
committed
fix(python/server): verify request signatures instead of accepting everything
katyalai
committed
feat(python/client): sign happy-path requests with an ephemeral key
katyalai
committed
docs(python): document request-signature verification and demo flags
katyalai
committed
test(python/server): self-review hardening + full coverage for the verifier

vishkaty
authored and
katyalai
committed
feat(python/server): align key discovery with merged ucp#566

vishkaty
authored and
katyalai
committed
feat(python/server): verify signatures on the MCP transport route too
katyalai
committed
style: apply ruff-format to signing.py
katyalai
committed