From 9d20bb777fd019794bfbf35a3f36c498494a58d2 Mon Sep 17 00:00:00 2001
From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com>
Date: Tue, 25 Aug 2026 13:06:10 -0700
Subject: [PATCH] spec(4.1.1): let "all Merkle tree constructions" mean all

The clause claims to cover every construction and parenthetically names two,
corpus merkle_root and tool catalog_hash, while the specification defines five
leaf constructions using the 0x00 convention:

  3.2.2    SHA-256(0x00 || raw sub-bundle digest bytes)   composite policy
  3.2.3    SHA-256(0x00 || tool_id || 0x00 || schema_hash || description_hash)
  3.2.5.1  corpus documents
  3.2.6    H(0x00 || tag || canonical_op)                 memory root
  3.2.7    H(0x00 || "am-trace-entry\x00" || canonical_entry)

A reader starting at 4.1.1 does not reach the composite rule #335 made
normative, and the leaf_data pointer names only two of the five sections.

Drops the enumeration rather than extending it. The parenthetical has gone
stale twice in a month, once when 3.2.6 and 3.2.7 were added and again when
#335 landed, and extending it guarantees a third time. The per-section
definitions are already normative and already complete, so they are the single
source.

No construction changes. This states the scope the clause already intends.

Reported by @Mayur021 in #337.

Signed-off-by: Imran Siddique <45405841+imran-siddique@users.noreply.github.com>
---
 spec/agent-manifest-spec-v0.2.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/agent-manifest-spec-v0.2.md b/spec/agent-manifest-spec-v0.2.md
index cf6fa110..c5bf11a6 100644
--- a/spec/agent-manifest-spec-v0.2.md
+++ b/spec/agent-manifest-spec-v0.2.md
@@ -1224,9 +1224,9 @@ The standard cryptographic profile uses the following primitives:
 
 ##### 4.1.1 Merkle Tree Domain Separation <!-- CHANGED: CRYPTO-005 - explicit domain separation per RFC 9162 to prevent length-extension attacks -->
 
-All Merkle tree constructions in this specification (corpus `merkle_root`, tool `catalog_hash`) MUST use the RFC 9162 / RFC 6962 domain-separated hashing convention:
+All Merkle tree constructions in this specification MUST use the RFC 9162 / RFC 6962 domain-separated hashing convention: <!-- CHANGED: #337 - the parenthetical named two of five constructions and went stale twice; the per-section definitions are now the single source -->
 
-- Leaf hash: `SHA-256(0x00 || leaf_data)` where `leaf_data` is the per-item input bytes as defined in the relevant section (section 3.2.3 for catalog, section 3.2.5.1 for corpus).
+- Leaf hash: `SHA-256(0x00 || leaf_data)`, where `leaf_data` is defined by the section specifying that construction.
 - Interior node hash: `SHA-256(0x01 || left_child_hash || right_child_hash)`.
 
 The `0x00` and `0x01` domain separation prefixes prevent second-preimage attacks that are possible with plain Merkle-Damgard SHA-256 trees lacking domain separation (as demonstrated in the Certificate Transparency literature). This construction is referenced in RFC 9162 Section 2.1.