fix(security): close fail-open paths in four example verifiers, add ClusterFuzzLite

[imran-siddique]

Every bug below was reproduced with a failing test before the fix.

industrial-embodied-ai

• controller.py: a NaN max_speed_mps compared false against both bounds and the controller accepted the motion. json.loads takes a bare NaN, so it arrives over the wire. An integer past the float range raised OverflowError instead of SafetyRejected. Tests: test_non_finite_speed_is_rejected, test_speed_too_large_for_float_is_rejected.
• validate_artifacts.py: every check was an assert. Under python -O a tampered system-prompt.txt printed "valid" on all four lines. Now explicit checks, and every top-level manifest field must be in signed_fields (an injected unsigned field used to pass). Checked by hand with -O against a tampered copy; test_validate_artifacts.py pins the no-assert property.

agentic-commerce-accountability verify_purchase.py accepted a negative, zero, float or boolean amount, a NaN ceiling, a string allow-list (membership became a substring test), and runtime evidence from an agent other than the grant's delegate. Four new tests.

embodied-action-receipts verify_receipts.py: the lenient base64 decoder let !!!! or extra padding inside a signature still verify. Malformed fixtures escaped as KeyError, TypeError or binascii.Error; they now return invalid/malformed. Three new tests.

ca2a-delegation called verify_chain without trusted_root_issuers, which the library documents as structural only. A chain an attacker signs from their own key passed. The scenario now pins the platform root. Test: test_chain_from_an_untrusted_root_is_rejected.

Docs. The healthcare and financial-services READMEs said PHI and mnpi data only flow through attested runtimes. The Cedar rule fires only on attestation_platform == "unknown", and the committed dev-mode records show four PHI calls allowed on software-only. The text now says what the rule does. ards/README.md no longer says every TRACE record proves a TEE run.

Scorecard

• FuzzingID (ci: add end-to-end smoke test for startup-tpm example #26): .clusterfuzzlite/ with three targets (receipts, purchase, controller), seeded from the committed fixtures. Before the fixes they find the controller overflow, the purchase acceptances and the receipt crashes; after, 23,828 driven inputs are clean. Atheris has no Windows wheel, so the local run drove TestOneInput through a shim.
• PinnedDependencies chore(deps): bump actions/setup-python from 5 to 6 #49: the receipts job installs from a new hashed lock, requirements/receipts-tests.txt.

Tests: 49 before, 60 after, all passing across the seven unittest jobs. actionlint 1.7.12 clean.

Generated with Claude Code