Protocol Buffers deterministic serialization is not a canonical message identity

What it is

Protocol Buffers explicitly documents that serialization is not canonical. Deterministic serialization does not establish one stable byte representation across implementations or versions, especially when unknown fields are involved. A hash of serialized bytes identifies those bytes, which is a different requirement from identifying a message's semantic content. Protocol Buffers serialization is not canonical

Why it matters

An agent may enable a deterministic option to repair a cache-key mismatch and assume the issue is permanently solved. First name the identity being requested: exact transport payload, application record or normalized business meaning. Only then choose what is compared or hashed.

How to apply

• Trace the current fingerprint input and every producer that can generate it. Identify runtime upgrades, unknown fields, maps and schema changes as cases to review.
• For exact-payload identity, preserve and hash the agreed byte sequence without claiming semantic equivalence. Document that another valid serialization can receive a different identity.
• For application-level identity, define a separate versioned projection of relevant fields and an explicit encoding contract. Decide how absent, default, repeated and unknown data affect that projection.
• Propose fixtures representing the same application meaning through different construction orders and supported runtimes. Also include messages differing only in fields the projection intentionally ignores.
• Review the consequences of changing the projection: cache migration, deduplication and existing signatures need an explicit transition policy.

Pitfalls

There is no universal normalization recipe here. Ignoring unknown fields can collapse messages whose future meanings differ, while preserving opaque unknown bytes may preserve unstable representation details. Do not advertise a home-made canonicalizer as a cryptographic standard. This article proposes an identity-design review and no implementation or cross-version fingerprint test has been executed for it.