Items 4 + 5 from the v1.4 roadmap, shipped together across all four
SDKs (Rust, JavaScript, Python, Go). All additions are additive optional
fields / parameters; v1.3 verifiers and existing v1.4 alpha.1/alpha.2
signatures are unaffected.
Item 4 — Canonicalization Algorithm Identifier
==============================================
Optional "canonicalization" field on .schemapin.sig naming the
algorithm used to produce the signing input. Forward-compatibility
hook so a future v2.x can swap canonicalization without breaking v1.x
signatures.
* Current and only supported value: "schemapin-v1" (the algorithm in
 §4 of the spec).
* Absence is equivalent to "schemapin-v1" (v1.3 backward compatibility).
* Any other value is a hard failure surfacing as the new
 CANONICALIZATION_UNSUPPORTED / canonicalization_unsupported error
 code. The check executes before any cryptographic work.
Sign-time API:
* Rust: SignOptions::with_canonicalization(algorithm).
* JavaScript: SignOptions { canonicalization } on signSkillWithOptions.
* Python: SignOptions(canonicalization=...).
* Go: SignOptions{ Canonicalization: ... }.
Verifier API:
* Rust: verify_schema_offline_with_canonicalization(...).
* JavaScript: optional `canonicalization` parameter on
 verifySchemaOffline.
* Python: optional `canonicalization` keyword arg on
 verify_schema_offline.
* Go: VerifySchemaOfflineWithCanonicalization(...).
* Skill flow: VerifySkillOffline-family functions now check
 sig.canonicalization automatically.
Item 5 — A2A Verification Context
=================================
A2aVerificationContext and verify_schema_for_a2a wrap the standard
7-step verification flow with an A2A scope check that closes the
cross-protocol loop with AgentPin v0.3 AllowedDomains (AgentPin
spec §4.11).
A2aVerificationContext fields:
* caller_agent_id (URN-style, matching AgentPin; informational)
* delegation_depth (u8; 0 = direct caller)
* originating_domain (informational)
* trusted_domains (string list; empty = unrestricted per AgentPin
 convention)
Verification algorithm:
1. Reject when delegation_depth > A2A_MAX_DELEGATION_DEPTH (= 3 to
 match AgentPin's max_delegation_depth cap; must move in lockstep
 with AgentPin if ever bumped).
2. Run the standard 7-step verification (with the §19
 canonicalization check). If it fails, return that result
 unchanged — A2A scope is not a remedy for cryptographic failure.
3. When trusted_domains is non-empty, reject when the provider
 domain is not allowed by it (wildcard-aware via *.suffix
 matching from AgentPin spec §5.5).
Both rejections surface as the new A2A_SCOPE_VIOLATION error code.
AllowedDomains helpers (is_unrestricted / allows / intersect) are
re-implemented locally in each SDK rather than via a dependency on
the AgentPin SDK — keeps SchemaPin self-contained for tool-integrity-
only deployments and avoids a circular trust-stack dependency. The
wire and in-memory shapes are byte-identical to AgentPin's so
callers linking both packages can pass agentpin's intersect()
results directly into trusted_domains.
Important implementation detail: verify_schema_for_a2a uses
allows(trusted_domains, domain) DIRECTLY, not
allows(intersect(trusted_domains, [domain])). The intersection
helper has a documented edge case (AgentPin spec §4.11.4) where two
non-empty disjoint allow-lists intersect to [] which the convention
treats as unrestricted — using intersect here would silently bypass
the scope check.
Spec and CHANGELOG
==================
* TECHNICAL_SPECIFICATION.md bumped from v1.2 header to v1.4
 (alpha.3) with a top-of-doc summary; new §19 (Canonicalization
 Algorithm Identifier) and §20 (A2A Verification Context).
* CHANGELOG.md: new [1.4.0-alpha.3] entry above the alpha.2 entry.
* All four SDKs bumped to 1.4.0-alpha.3 (Python: 1.4.0a3 per PEP 440).
Test counts
===========
* Rust: 133 lib tests pass; cargo clippy -- -D warnings clean;
 cargo fmt clean.
* JavaScript: 180 tests pass (19 new A2A + canonicalization tests).
* Python: 201 tests pass (19 new A2A + canonicalization tests).
* Go: all packages green; go vet clean; gofmt -l empty.
Also includes pre-existing gofmt drift fixes on go/pkg/bundle/bundle.go,
go/pkg/revocation/revocation.go, go/pkg/skill/skill.go, and
go/pkg/skill/skill_test.go that surfaced when running gofmt -l
during pre-commit verification.
Items 6–8 of the v1.4 roadmap (A2A trust bundle distribution,
scan-aware signatures, cross-agent schema cache) follow in
1.4.0-alpha.4 and 1.4.0 final per the local scope doc at
docs/superpowers/specs/2026-05-15-v1.4-remaining-items.md.