Adversarial canonicalization challenge: break sorted-json-v1 across runtimes

[aruintelligence]

Status

OPEN ADVERSARIAL SPECIFICATION CHALLENGE

Cryptographic interoperability fails if two runtimes serialize the same JSON value to different bytes.

Current profile:
https://github.com/aruintelligence/aml-core/blob/main/protocol/sorted-json-v1.md

Golden vectors:
https://github.com/aruintelligence/aml-core/blob/main/protocol/browser-canonicalization-vectors.json

Current cross-language checks cover objects, arrays, Unicode strings, booleans, null, and integers inside JavaScript's safe integer range.

Challenge

Find a JSON-compatible input where two reasonable implementations of the current sorted-json-v1 wording produce different canonical bytes or SHA-256.

High-value targets include:

• non-integer IEEE-754 values;
• -0;
• exponent formatting;
• Unicode edge cases;
• escaping differences;
• object-key ordering edge cases;
• values near JavaScript's safe-integer boundary.

What to submit

Reply with:

• exact JSON input;
• runtime A + canonical bytes/hash;
• runtime B + canonical bytes/hash;
• why both behaviors appear consistent with the current wording;
• proposed clarification or reason to create a new canonicalization version.

Rules

Do not silently redefine sorted-json-v1. If stronger byte semantics are needed, the project should version the canonicalization identifier and publish new golden vectors.

Claim boundary

sorted-json-v1 is a project-defined prototype profile. It is not represented as an IETF, W3C, WHATWG, ISO, or other externally ratified standard.