</details>

<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

```suggestion

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/execution-receipts.md` around lines 99 - 101, The fenced code block
containing the command "python
tests/vectors/execution_receipt_v0/_check_independent.py" is untyped and
triggers markdownlint MD040; update that fenced block in
docs/execution-receipts.md by adding a language tag (e.g., bash) after the
opening backticks so the block reads as a bash fenced code block, ensuring the
linter no longer flags it.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/generate_receipt_vectors.py` around lines 67 - 91, _emit_keys
currently always generates new ES256/RS256 keys and overwrites committed PEM
fixtures; change it to reuse existing files under OUT/"keys" when present and
only generate and write new keys (and hs256_secret.bin) if the files are
missing. Specifically, have _emit_keys check for the existence of
"hs256_secret.bin", "es256_private.pem"/"es256_public.pem", and
"rs256_private.pem"/"rs256_public.pem" in the keys directory; if present, read
and deserialize the private PEMs with serialization.load_pem_private_key to
obtain the ec and rsa private key objects, otherwise generate the keys and write
the PEMs as before. Ensure directory creation remains (keys.mkdir) and return
the same dict shape {"ES256": es, "RS256": rs} with the loaded or newly
generated key objects.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/vaara/adversarial_classifier.py` around lines 61 - 72, The current
_METADATA_SSRF_PATTERNS use bare substring regexes which over- and under-match;
update each pattern to require non-host/digit boundaries so they match the
intended full host/IP/token only and enable case-insensitive matching for
hostnames: e.g. replace re.compile(r"169\.254\.169\.254") and
re.compile(r"169\.254\.170\.2") with boundary-protected variants like
re.compile(r"(?<![A-Za-z0-9_.-])169\.254\.169\.254(?![A-Za-z0-9_.-])"),
re.compile(r"(?<![A-Za-z0-9_.-])169\.254\.170\.2(?![A-Za-z0-9_.-])"); make
metadata.google.internal case-insensitive and boundary-protected using
re.compile(r"(?<![A-Za-z0-9_.-])metadata\.google\.internal(?![A-Za-z0-9_.-])",
re.I); apply analogous boundary anchors to the IPv6 pattern (fd00:ec2::254) and
to the dotless decimal/hex patterns (2852039166 and 0xa9fea9fe) so they can’t be
matched as substrings of longer tokens while preserving the existing re.I where
needed, leaving the list name _METADATA_SSRF_PATTERNS untouched.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/vaara/adversarial_classifier.py` around lines 263 - 265, The current code
JSON-dumps the entire entry and applies _METADATA_SSRF_PATTERNS against that
blob, which incorrectly elevates probability when non-destination fields (like
context/original_task) mention metadata IPs; change the check to only scan
destination-bearing values: iterate entry's keys and for each value that is a
string (or convert non-string scalars/nested values individually to strings),
run the existing _METADATA_SSRF_PATTERNS against that single value, and only if
a pattern matches one of those values return max(prob, _METADATA_SSRF_FLOOR);
keep using the same names (entry, prob, _METADATA_SSRF_PATTERNS,
_METADATA_SSRF_FLOOR) so the logic targets host/URL-bearing fields instead of
the whole blob.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/vaara/attestation/_receipt_types.py` around lines 93 - 106,
OutcomeDerived allows an invalid combination of status and result_commitment;
add a __post_init__ on the OutcomeDerived dataclass to validate the invariant:
if status == ReceiptStatus.REFUSED then result_commitment must be None, and if
status is EXECUTED or ERRORED then result_commitment must be present; if the
check fails raise a ValueError with a clear message. Implement the check inside
OutcomeDerived.__post_init__ (no other changes to callers), referencing the
status and result_commitment attributes to enforce the rule.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/vaara/attestation/_receipt_types.py` around lines 213 - 235, The
top-level alg and the nested receiptAsserted.alg must be compared and rejected
if they differ: in receipt_from_dict, after validating d["alg"] and creating
receipt_asserted via receipt_asserted_from_dict(d["receiptAsserted"]), check
that receipt_asserted.alg (or its equivalent attribute) equals d["alg"] and
raise AttestationError with a clear message if not; alternatively implement the
same check in ExecutionReceipt.__post_init__ to enforce consistency on
construction.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/vectors/execution_receipt_v0/README.md` around lines 9 - 22, Update the
fenced code blocks in tests/vectors/execution_receipt_v0/README.md to include
language identifiers: change the layout/tree fence to ```text (the block that
lists keys/, normative/<case>/, etc.) and change the command fence that runs
_check_independent.py to ```bash; apply the same text/bash annotations for the
other matching fence at lines referenced (37-39) so markdownlint stops flagging
them.