[achamayou]

Motivation

COSE.encode_and_sign currently annotates its protected and unprotected headers as Optional[dict]. This causes two problems for strict type-checking consumers:

• Bare dictionaries expose unknown key/value types, triggering Pyright’s reportUnknownMemberType.
• The annotations reject ResolvedHeader, although the implementation already accepts it.

This blocks strict checking of ccf.cose in microsoft/CCF#8675. This code needs ResolvedHeader to preserve application-defined labels and values without named-header resolution or value conversion.

Changes

1. Annotate both header parameters as Optional[Union[Dict[Any, Any], ResolvedHeader]], matching the existing typing style and Python 3.10 support. Explicit Any accommodates arbitrary header contents and preserves compatibility with parameterized dictionary callers.
2. Document ResolvedHeader and its bypass semantics in both parameter descriptions.
3. Add a strict-consumer fixture covering dictionaries, wrappers, mixed arguments, omitted headers, and explicit None.
4. Extend runtime coverage for signature verification, header preservation, ordinary named-header resolution, deterministic encoding, and bytes/CBORTag output.
5. Add an entry to the existing changelog.

Runtime implementation, defaults, parameter ordering, serialization, cryptographic behavior, and the Union[bytes, CBORTag] return annotation remain unchanged.

Validation

• On the branch from microsoft/CCF#8675, removing the header cast and enabling strict checking for ccf.cose produces zero diagnostics across all 13 package modules; all 270 SDK tests pass. The patched wheel was installed inside the actual isolated uvx environment used for checking.

This PR was produced with the help of AI, but I reviewed it entirely and believe the changes are correct.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.01%. Comparing base (d867cb7) to head (b84fc66).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #707   +/-   ##
=======================================
  Coverage   97.01%   97.01%           
=======================================
  Files          32       32           
  Lines        3445     3445           
=======================================
  Hits         3342     3342           
  Misses        103      103           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dajiaji]

Thanks @achamayou! Verified locally: all tests and pre-commit checks pass, and Pyright strict now reports no diagnostics for encode_and_sign. Merging as is.

I'll follow up separately to align the annotations of the other encode_* methods and add a typing check. Thanks for the contribution!