[bokelley]

Fixes #1624 (part 2: normalize_url whitespace; part 1, display_tag inference, is #1628)

Problem

normalize_url(" https://interchange.io ")  # 'interchange.io '
normalize_url("https://interchange.io")    # 'interchange.io'

urlparse drops leading whitespace but keeps trailing whitespace in the path. An adagents.json entry whose url carries stray whitespace therefore didn't match its agent in find_authorized_agent_entries, verify_agent_authorization, get_properties_by_agent or resolve_properties_for_agent.

Fix

normalize_url strips the input before parsing. Both sides of the comparison go through it, so a padded document entry and a padded caller-supplied agent URL both match.

Other normalizers checked

• adagents._normalize_domain already strips. No change.
• adagents.fetch_publisher_signing_pins and the signing-side entry matches (brand_authz._canonical_agent_match, brand_jwks agent selection, agent_resolver's signer/entry consistency check) compare with canonicalize_target_uri. That is the RFC 9421 signature-base canonicalizer and must stay byte-exact. These matches select signing keys or the signer identity, and a padded URL already fails closed there (not authorized, or SignatureVerificationError), so they don't silently pick the wrong agent. Judgement call: I left them byte-exact rather than loosen key-selection paths in a small fix.
• signing.canonical.canonicalize_target_uri / canonicalize_authority (signature bases) are unchanged.

Tests

Padded and tab/newline-wrapped listed URLs match through every public matcher. The issue's example is covered in both directions.

make lint, make typecheck-all and make test were run locally. One unrelated A2A integration test (test_a2a_context_id) flakes under local -n 8 on every branch, and it passed in #1626's CI.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — clean one-line fix with test coverage.

normalize_url now strips surrounding whitespace before urlparse, closing the asymmetry where urlparse dropped leading but kept trailing whitespace in the path. This fixes the case where a padded adagents.json url failed to match its agent across the four public matchers. Both comparison sides route through normalize_url, and tests cover both directions plus the public matcher.

Checked: no public signature change, no wire-field pathway owed, signing paths left byte-exact and documented. No blocking or medium findings.

Decision table: rows 1–8 do not fire (no critical/high/medium findings, gated_paths false, high_risk false, no no-auto-approve team match, fewer than three medium findings). Falls through to row 9 → approve. Note: review_decision is REVIEW_REQUIRED, but the gated_paths hard gate (row 2) only applies when gated_paths is true, which it is not here.