.NET/TS trust: verifyPeer rejects uppercase DID fingerprint despite case-insensitive format check

[DhineshPonnarasan]

Summary

TrustManager.verifyPeer accepts uppercase hexadecimal DID fingerprints at format-validation time, but then compares the fingerprint to a lowercase digest using a case-sensitive string comparison.

This rejects an otherwise valid fingerprint value that differs only by hex letter casing.

Reproduction (public API)

1. Generate an identity with AgentIdentity.generate("peer-agent").
2. Export with exportJSON() and replace the DID fingerprint suffix with its uppercase form.
3. Re-import via AgentIdentity.fromJSON(...).
4. Call TrustManager.verifyPeer("peer-agent", identity).

Observed result:

• verified === false
• reason === "Peer identity DID fingerprint does not match the public key"

Additional check in the same repro:

• uppercaseFingerprint.toLowerCase() === expectedFingerprint.toLowerCase() is true.

Expected behavior

If fingerprint format validation accepts uppercase hex, verification should not fail when the value differs only by case.

Actual behavior

Verification fails due to case-sensitive comparison.

Implementation evidence

In agent-governance-typescript/src/trust.ts:

• format check uses /^[0-9a-f]{16}$/i (case-insensitive)
• comparison uses didFingerprint !== expectedFingerprint (case-sensitive)

Suggested fix

Normalize both values before comparison (for example, compare ToLowerInvariant() / .toLowerCase() values) so the comparison matches the accepted hex format semantics.

Environment

• Repository: microsoft/agent-governance-toolkit
• Branch: main
• Commit verified: e5693cb11db5e336508ee0a793356ccfb84c1834
• Platform used for repro: Windows

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[saisharan0103]

TrustManager.verifyPeer accepts the fingerprint with /^[0-9a-f]{16}$/i, then compares didFingerprint to expectedFingerprint with case-sensitive string equality. For a PR, I would start by normalizing both values at the comparison point so validation and verification use the same hex casing semantics. The regression test should import an identity whose DID fingerprint suffix is uppercase and assert verification succeeds.