@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/session-ceremony.js

@@ -1,964 +0,0 @@
-/**
- * Session-signing FROST ceremony participation — daemon side (DOD-SPINE-5, increment 3).
- *
- * When an initiator's `cello_initiate_session` reaches the directory, the directory
- * FROST-signs the SessionAssignment by DELEGATING to the initiator: its
- * `ClientDelegatedSigner.participateInCeremony` sends a `ceremony_request`
- * {ceremony_id, tbs, context} over the initiator's authenticated signaling stream and
- * awaits a `ceremony_result` {ceremony_id, signature}. The initiator (coordinator) runs
- * the FROST ceremony with its share + the directory's K_server_X shares, and replies.
- *
- * This wires that handler onto a PER-AGENT signaling stream (the same per-agent routing used for
- * registration).
- *
- * The threshold signer is reconstructed lazily from the agent's persisted
- * `frost-share.json` (the daemon holds no FrostThresholdSigner after registration —
- * the registration-time signer was on the disposed RegistrationContext).
- */
-import { decode } from "cbor-x";
-import { encodeCbor } from "@cello-protocol/protocol-types";
-import { createHash } from "node:crypto";
-import { buildSealTbs } from "@cello-protocol/protocol-types";
-import { bindLegibilityToTbs } from "./seal-legibility-tbs.js";
-import { reDeriveFrontiers, findInflatedFrontier } from "./seal-frontier-verify.js";
-import { FrostThresholdSigner } from "@cello-protocol/crypto";
-import { storeDkgResult } from "@cello-protocol/crypto/frost/frost-threshold-signer.js";
-import { NetworkDirectoryNode, runNetworkRefresh } from "./network-directory-node.js";
-import { extractErrorMessage } from "./error-message.js";
-/**
- * WIRE-002: answer the directory's `session_offer` on a per-agent signaling stream. When an
- * initiator's session_request names this agent as the target, the directory sends a
- * `session_offer {session_id}` before it builds the FROST-signed assignment; the agent must
- * reply `session_offer_accept` advertising its SESSION endpoint (its standing receiver, which
- * `acceptSession` reuses as the receiver-side session node) so the directory can fold the
- * counterparty endpoint into the assignment and the initiator can reach it. Without this, the
- * assignment carries an empty counterparty endpoint and content delivery can never connect.
- */
-export function wireSessionOfferHandler(deps) {
-    // DOD-OFFER-REJECT-1 (D1): answer, never vanish. A silent abort left the directory waiting
-    // 2 s for an accept that would never come, after which it FROST-signed an assignment with an
-    // EMPTY counterparty endpoint and pushed it to both parties — the phantom session's origin.
-    // The reject lets the directory fail fast (D2 resolves its waiter on this frame; until the
-    // directory understands it, the frame is inert and the timeout path still applies). This is
-    // the Generic Reject of the inbound-state matrix, arriving as a protocol necessity.
-    // session_id is echoed when present; a no_session_id offer has nothing to echo, so the field
-    // is omitted (never an empty value on the wire — same rule as the directory's encoder).
-    async function sendOfferReject(sessionId, reason) {
-        const rejectFrame = { type: "session_offer_reject", reason };
-        if (sessionId)
-            rejectFrame["session_id"] = sessionId;
-        try {
-            // The production seam (transport SignalingManager.sendRaw) NEVER throws — it resolves
-            // {ok:false, reason} on every failure (reconnecting, lost, stream throw). Discarding the
-            // result would log reject.sent while nothing left the machine (D1 review F1). The catch
-            // stays as belt-and-braces for a seam that does throw.
-            const res = await deps.signaling.sendRaw(rejectFrame);
-            if (res.ok) {
-                deps.logger.info("session.offer.reject.sent", { agentName: deps.agentName, reason });
-            }
-            else {
-                deps.logger.warn("session.offer.reject.failed", {
-                    agentName: deps.agentName,
-                    reason,
-                    detail: res.reason ?? "send_not_ok",
-                    ...(res.guidance ? { guidance: res.guidance } : {}),
-                });
-            }
-        }
-        catch (err) {
-            deps.logger.warn("session.offer.reject.failed", {
-                agentName: deps.agentName,
-                reason,
-                detail: extractErrorMessage(err),
-            });
-        }
-    }
-    return deps.signaling.registerInboundHandler((frame) => {
-        if (frame["type"] !== "session_offer")
-            return;
-        void (async () => {
-            const sidRaw = frame["session_id"];
-            const sessionId = sidRaw instanceof Uint8Array ? sidRaw : Buffer.isBuffer(sidRaw) ? new Uint8Array(sidRaw) : null;
-            if (!sessionId) {
-                deps.logger.warn("session.offer.abort", { agentName: deps.agentName, reason: "no_session_id" });
-                await sendOfferReject(null, "no_session_id");
-                return;
-            }
-            /**
-             * M16: A CHANNEL NEVER CONVERSES — and it says so BEFORE it gives anything away. Accepting here
-             * would take a relay reservation and send the caller this agent's session peer id and
-             * addresses, all for a session the verified assignment is then refused over. The offer is
-             * unauthenticated, but this question is about the LOCAL agent only, so a forged offer can do
-             * no more than trigger a refusal that was coming anyway. The assignment gate in
-             * inbound-sessions.ts stays as the authenticated line.
-             */
-            if (deps.isChannelAgent()) {
-                deps.logger.warn("session.offer.abort", { agentName: deps.agentName, reason: "channel_identity" });
-                await sendOfferReject(sessionId, "channel_identity");
-                return;
-            }
-            let sr = deps.getStandingReceiverEndpoint();
-            if (!sr) {
-                deps.logger.warn("session.offer.abort", { agentName: deps.agentName, reason: "standing_receiver_unavailable" });
-                await sendOfferReject(sessionId, "standing_receiver_unavailable");
-                return;
-            }
-            /**
-             * 055-ONDEMAND — **RESERVE NOW, BECAUSE AN IDLE AGENT HOLDS NOTHING.**
-             *
-             * This is the whole of the capacity change, seen from the receiving end. The agent no longer
-             * carries a slot on every relay against the chance that somebody calls; it takes ONE, on the
-             * relay this offer names, at the moment somebody does. The accept below then advertises the
-             * circuit address that came back.
-             *
-             * ⚠️ **THE RELAY IS THE DIRECTORY'S CHOICE, NOT OURS.** The assignment the relay will check
-             * names the same relay, from the same variable on the directory's side. Reserving on one we
-             * picked ourselves would leave us holding a slot the relay will not route through.
-             *
-             * ⚠️ **A FAILURE HERE IS NOT FATAL BY ITSELF.** Without a circuit we are still reachable by a
-             * peer that can dial us directly; it is relay-only that turns this into a refusal, and that
-             * check is deliberately BELOW this line rather than above it — see its own note.
-             */
-            const offeredRelay = frame["relay_endpoint"];
-            const relayPeerId = typeof offeredRelay?.peer_id === "string" ? offeredRelay.peer_id : null;
-            const relayAddrs = Array.isArray(offeredRelay?.multiaddrs)
-                ? offeredRelay.multiaddrs.filter((a) => typeof a === "string")
-                : [];
-            if (relayPeerId && relayAddrs.length > 0) {
-                const base = relayAddrs[0];
-                // The circuit address form the walk uses: the relay's own address with `/p2p-circuit`.
-                const circuitAddr = base.includes(`/p2p/${relayPeerId}`)
-                    ? `${base}/p2p-circuit`
-                    : `${base}/p2p/${relayPeerId}/p2p-circuit`;
-                const took = await deps.reserveOnDemand(circuitAddr, Buffer.from(sessionId).toString("hex"));
-                deps.logger.info("session.offer.reservation", {
-                    agentName: deps.agentName,
-                    relayPeerId,
-                    granted: took,
-                    impact: took
-                        ? "this agent is dialable through the relay the directory named, for the life of this session"
-                        : "no reservation on the offered relay — a counterparty behind NAT cannot dial this " +
-                            "agent for this session, and it will be reached over the relay's store-and-forward",
-                });
-                // Re-read: the endpoint we advertise has to include the circuit we just took.
-                sr = deps.getStandingReceiverEndpoint() ?? sr;
-            }
-            else {
-                /**
-                 * ⚠️ **AN OFFER THAT NAMES NO RELAY USED TO ASK NOBODY AND SAY NOTHING — 056-SLOTDEAD, F8.**
-                 *
-                 * `session.offer.reservation` only fires when a relay WAS named, so this branch was silent.
-                 * The failure that makes silence expensive: if the directory stops naming a relay — an old
-                 * node in the pool, a bad roll, a regression in `pickRelay` — a relay-only agent refuses
-                 * every inbound call with `relay_only_no_reservation`. That reason reads as "no relay would
-                 * grant me a slot", so the operator goes and looks at relay capacity, and the fault is on
-                 * the directory and has nothing to do with slots. One line makes that a grep.
-                 *
-                 * INFO, not WARN: against a directory that has not rolled yet this is the expected shape,
-                 * and the agent degrades correctly to its direct address. It is loud enough to find, and it
-                 * says which of the two states it is.
-                 */
-                deps.logger.info("session.offer.reservation.not_offered", {
-                    agentName: deps.agentName,
-                    hasRelayEndpoint: offeredRelay !== undefined,
-                    impact: offeredRelay === undefined
-                        ? "the directory's offer named no relay, so this agent asked nobody for a slot and will " +
-                            "answer with the addresses it already has. Expected against a directory that predates " +
-                            "on-demand reservations; unexpected otherwise, and under relay-only it means the call " +
-                            "is about to be refused for a reason that points at the wrong side."
-                        : "the offer carried a relay_endpoint this agent could not read — no usable peer id or " +
-                            "no multiaddrs — so no slot was asked for. That is a malformed frame from the " +
-                            "directory, not a relay at capacity.",
-                });
-            }
-            // DOD-M15-RELAYONLY-1: ANSWER, never publish an empty address list — **but only when
-            // relay-only is what emptied it.**
-            //
-            // ⚠️ An empty `addrs` is NOT exclusively a relay-only condition, and the first version of this
-            // guard refused unconditionally — which broke the pre-existing accept path for a receiver that
-            // legitimately has no addresses yet, a case `session-ceremony-verify` covers on purpose. A
-            // privacy control that changes behaviour when it is switched OFF is its own defect.
-            //
-            // ⚠️ Under relay-only the endpoint is already filtered to circuit addresses, and with no relay
-            // reservation that set is EMPTY. The directory folds an accept only
-            // `if (counterparty_session_addrs.length > 0)` — **with no `else`** — so an empty accept is
-            // dropped in silence, the offer waiter never resolves, and the INITIATOR's operator is told
-            // `counterparty_unavailable`: a lie about our state, produced by our setting. Rejecting
-            // explicitly keeps the failure attributable to the side that caused it, and is the same
-            // answer-never-vanish contract the reject path above already implements.
-            /**
-             * ⚠️ **AFTER THE ON-DEMAND RESERVE, NOT BEFORE IT — 055-ONDEMAND.** An idle agent holds no
-             * reservation by design now, so this guard sitting above the reserve would fire on EVERY
-             * inbound offer and take `DOD-M15-RELAYONLY-1` — the control that stops a session revealing
-             * the operator's IP — to a 100% refusal rate. Down here it means what it has always meant:
-             * relay-only is on and we could not get a circuit, so there is nothing we are willing to
-             * advertise.
-             */
-            if (sr.addrs.length === 0 && (deps.isRelayOnly?.() ?? false)) {
-                deps.logger.warn("session.offer.abort", {
-                    agentName: deps.agentName,
-                    reason: "relay_only_no_reservation",
-                    impact: "relay-only is on and this agent holds no relay reservation, so it has no circuit " +
-                        "address to advertise and will not reveal its own — the offer is refused rather than " +
-                        "answered with an empty endpoint the directory would silently drop",
-                });
-                await sendOfferReject(sessionId, "relay_only_no_reservation");
-                return;
-            }
-            /**
-             * DOD-M15-ASSIGN-1 — open the door to the named dialer, and ONLY then publish our address.
-             *
-             * The ordering is the whole mechanism. Our receiver admits nobody until this line runs; the
-             * accept below is what tells the directory (and through it, the initiator) where we listen.
-             * Narrowing first means the gate names the initiator before the initiator can possibly know
-             * where to dial, so there is no interval in which the address is reachable by anyone else.
-             *
-             * REFUSED WHEN THE OFFER NAMES NOBODY. The directory rejects any session_request that omits
-             * `initiator_session_peer_id` (`session_request_missing_peer_id`), so a well-formed request
-             * cannot produce a nameless offer — one here means a directory that is broken or lying.
-             * Advertising anyway would be the worse failure: the initiator would dial an address whose
-             * gate refuses them, and the session would die at the transport with no one able to say why.
-             * Rejecting names the cause on the frame the directory is already waiting for.
-             */
-            const offeredDialerRaw = frame["initiator_session_peer_id"];
-            const offeredDialer = typeof offeredDialerRaw === "string" ? offeredDialerRaw : "";
-            // Keyed by SESSION (review F1): two overlapping offers to one agent must not overwrite
-            // each other's record, or a legitimate session is refused and the check disarms itself.
-            const narrowed = deps.admitOfferedDialer(offeredDialer, Buffer.from(sessionId).toString("hex"));
-            if (narrowed !== "narrowed") {
-                /**
-                 * Review F6 — ONE REASON PER CAUSE. This branch used to report `offer_named_no_dialer` for
-                 * both outcomes, and its guidance sent the operator to "the directory is not populating
-                 * initiator_session_peer_id" even when the truth was that this agent had no standing
-                 * receiver. That is a local problem wearing a remote label, which is the exact shape that
-                 * costs days. `standing_receiver_unavailable` already exists two branches above and is the
-                 * correct name for it.
-                 */
-                const isLocal = narrowed === "no_receiver";
-                const reason = isLocal ? "standing_receiver_unavailable" : "offer_named_no_dialer";
-                deps.logger.warn("session.offer.abort", {
-                    agentName: deps.agentName,
-                    reason,
-                    impact: isLocal
-                        ? "this agent has no standing receiver to open, so it cannot serve the session; the session was refused rather than accepted with nowhere to be dialled"
-                        : "the directory's offer did not say who would dial, so this agent could not open its receiver to exactly one peer; the session was refused rather than served behind a door open to anyone",
-                    guidance: isLocal
-                        ? "the receiver is created when the agent comes online — check that cello_start_agent reached this daemon, then have the initiator retry"
-                        : "the initiator should retry; a repeat means the directory is not populating initiator_session_peer_id and the session cannot be established safely",
-                });
-                await sendOfferReject(sessionId, reason);
-                return;
-            }
-            try {
-                // Same production contract as the reject above (D1 review F3, pre-existing): sendRaw
-                // resolves {ok:false, reason} instead of throwing. Logging "accepted" on {ok:false}
-                // pointed the operator away from the exact failure that fabricates phantom sessions —
-                // the directory hears nothing, stalls 2 s, and signs an endpoint-less assignment.
-                const res = await deps.signaling.sendRaw({
-                    type: "session_offer_accept",
-                    session_id: sessionId,
-                    counterparty_session_peer_id: sr.peerId,
-                    counterparty_session_addrs: sr.addrs,
-                });
-                if (res.ok) {
-                    deps.logger.info("session.offer.accepted", {
-                        agentName: deps.agentName,
-                        sessionPeerId: sr.peerId,
-                    });
-                }
-                else {
-                    deps.logger.warn("session.offer.accept.failed", {
-                        agentName: deps.agentName,
-                        detail: res.reason ?? "send_not_ok",
-                        ...(res.guidance ? { guidance: res.guidance } : {}),
-                    });
-                }
-            }
-            catch (err) {
-                deps.logger.warn("session.offer.accept.failed", {
-                    agentName: deps.agentName,
-                    detail: extractErrorMessage(err),
-                });
-            }
-        })();
-    });
-}
-/**
- * Reconstruct the agent's FROST threshold signer from its persisted share, configured to
- * drive the ceremony's `/cello/frost/1.0.0` round-trips on the agent's directory node.
- * Returns null when no share is persisted or the share is unreadable.
- */
-async function hydrateShareAndStubs(deps) {
-    const share = await deps.persistence.loadActiveFrostKeyShare();
-    if (!share)
-        return null;
-    const frostSecret = { identifier: share.identifier, signingShare: new Uint8Array(share.signingShare) };
-    let commitments = [];
-    const verifyingShares = {};
-    try {
-        const dc = decode(Buffer.from(share.commitmentsCbor));
-        if (Array.isArray(dc)) {
-            commitments = dc.map((c) => c instanceof Uint8Array ? c : Buffer.isBuffer(c) ? new Uint8Array(c) : new Uint8Array(0));
-        }
-        const dvs = decode(Buffer.from(share.verifyingSharesCbor));
-        if (dvs && typeof dvs === "object" && !Array.isArray(dvs)) {
-            for (const [k, v] of Object.entries(dvs)) {
-                verifyingShares[k] = v instanceof Uint8Array ? v : Buffer.isBuffer(v) ? new Uint8Array(v) : new Uint8Array(0);
-            }
-        }
-    }
-    catch (err) {
-        deps.logger.error("session.ceremony.share.load.failed", {
-            agentName: deps.agentName,
-            reason: "cbor_deserialize_failed",
-            detail: extractErrorMessage(err),
-        });
-        return null;
-    }
-    const frostPublic = { signers: { min: share.threshold, max: share.participants + 1 }, commitments, verifyingShares };
-    try {
-        // SI-001: storeDkgResult does not log the secret. Cast via the function's own param
-        // types (the daemon has no direct @noble/curves dependency).
-        storeDkgResult(deps.agentPubkeyHex, frostSecret, frostPublic);
-    }
-    catch (err) {
-        deps.logger.error("session.ceremony.share.load.failed", {
-            agentName: deps.agentName,
-            reason: "storeDkgResult_failed",
-            detail: extractErrorMessage(err),
-        });
-        return null;
-    }
-    // DOD-SIGN-1: build a directory-node stub PER consortium node so the FROST threshold signer
-    // can run the signing ceremony across ALL N nodes (it reaches any T and excludes a node that's
-    // down — "kill a node, still signs"). With no consortium manifest configured the roster is null
-    // → the single primary endpoint (M6/M7 single-node back-compat). NOTE: the share's threshold T
-    // (from the multi-node DKG) is FIXED — a degraded roster (fewer than T reachable) makes signing
-    // FAIL, it can never forge a lower-threshold signature, so a single-stub fallback is safe.
-    let directoryNodeStubs;
-    const node = deps.getNode();
-    const roster = await deps.getConsortiumEndpoints();
-    // Use the share's CURRENT epoch (advances after a proactive refresh) — NOT a hardcoded epoch:1, else
-    // post-refresh signing would target the now-EXPIRED epoch and fail (DOD-REFRESH-1). For an un-refreshed
-    // agent share.epochId IS "…:epoch:1", so this is identical to the prior behavior.
-    const epochId = share.epochId;
-    // The stub's FROST identifier (`id`) MUST be the node's DKG label, NOT its libp2p peerId. The directory
-    // derives each node's FROST participant identifier as derive(nodeId), where nodeId = the node's region
-    // (frost-handler.ts:23 `nodeIdentifier = derive(nodeId)`; the bin sets nodeId = region). So the group's
-    // node shares are bound to derive(region), and the node SIGNS under derive(region). If the client verifies
-    // /aggregates partials under derive(peerId) instead, every verifyShare fails → all nodes excluded →
-    // ceremony_exhausted. `id` feeds Identifier.derive() in the signer; `directoryPeerId` is the network dial
-    // and stays the libp2p peerId. (nodeId and peerId coincide only for legacy single-node agents whose DKG
-    // predates the region-as-nodeId change — the single-node fallback below passes peerId for that reason.)
-    const mkStub = (nodeId, peerId, multiaddr) => {
-        const stub = new NetworkDirectoryNode({
-            id: nodeId,
-            node: node,
-            directoryPeerId: peerId,
-            directoryMultiaddrs: [multiaddr],
-            logger: deps.logger,
-        });
-        stub.setBootstrapContext(deps.agentPubkeyHex, epochId, (h) => deps.keyProvider.sign(h)); // SEC-2
-        return stub;
-    };
-    if (node && roster !== null && roster.length > 0) {
-        // M8B quorum: filter the live roster to the SHARE-HOLDER quorum Q the agent registered with
-        // (share.directoryNodeIds), so the seal targets holders — not nodes that came back online after a
-        // quorum registration but hold NO share for this agent (they'd pad the count via isReachable()===true
-        // and burn the retry budget). Absent Q (pre-quorum agent / single-node) → full roster (unchanged
-        // DOD-SIGN-1). Defensive: if every Q node has vanished from the roster, fall back to the full roster
-        // rather than an empty signer set (the ceremony's own below-threshold pre-check then applies).
-        const q = share.directoryNodeIds;
-        const filtered = q && q.length > 0 ? roster.filter((ep) => q.includes(ep.nodeId)) : roster;
-        const holders = filtered.length > 0 ? filtered : roster;
-        // FROST id = ep.nodeId (region — the DKG label); network dial = ep.peerId.
-        directoryNodeStubs = holders.map((ep) => mkStub(ep.nodeId, ep.peerId, ep.multiaddr));
-    }
-    else if (node) {
-        // No consortium manifest (roster null) or a configured manifest that resolved EMPTY → the single
-        // primary endpoint. INTENTIONAL asymmetry with DKG-1 (which REFUSES a configured-but-empty roster
-        // because DKG needs all N): for SIGNING the share's threshold T is FIXED, so a degraded/single
-        // stub makes participateInCeremony fail the `reachable < T-1` pre-check rather than forge a weaker
-        // seal — safe. WARN distinctly on the configured-but-unreachable case so the operator sees "your
-        // consortium was unreachable" rather than a generic below-threshold error (fallback-finder F3).
-        if (roster !== null && roster.length === 0) {
-            deps.logger.warn("session.ceremony.consortium_unreachable", { agentName: deps.agentName });
-        }
-        const ep = await deps.getDirectoryEndpoint();
-        if (ep && ep.multiaddr) {
-            // Single-node back-compat: no region is available from getDirectoryEndpoint, and legacy single-node
-            // agents' DKG labeled the node by peerId (pre region-as-nodeId), so the FROST id stays the peerId here.
-            directoryNodeStubs = [mkStub(ep.peerId, ep.peerId, ep.multiaddr)];
-        }
-    }
-    return { share, stubs: directoryNodeStubs };
-}
-export async function reconstructThresholdSigner(deps, 
-/**
- * DOD-M15-SEALPARTIES-1: the signed leaves this ceremony's TBS is a root over, forwarded to every
- * directory node so each reaches its own verdict instead of signing a claim. Supplied on the seal
- * ceremony and on nothing else — a co-signer requires it under the seal context and ignores it
- * everywhere else.
- */
-sealEvidence) {
-    const h = await hydrateShareAndStubs(deps);
-    if (!h)
-        return null;
-    if (sealEvidence)
-        for (const stub of h.stubs ?? [])
-            stub.setSealEvidence(sealEvidence);
-    return new FrostThresholdSigner({ threshold: h.share.threshold, participants: h.share.participants, directoryNodeStubs: h.stubs }, Buffer.from(deps.agentPubkeyHex, "hex"));
-}
-/**
- * M8B DOD-REFRESH-1: run a proactive share refresh for an already-registered agent. Rotates the client's
- * + every directory node's share to the next epoch (group public key unchanged), then persists the
- * client's new share as the active one so subsequent signing uses the new epoch and old-epoch shares die.
- */
-export async function runAgentRefresh(deps) {
-    const h = await hydrateShareAndStubs(deps);
-    if (!h)
-        return { ok: false, reason: "no_active_share" };
-    if (!h.stubs || h.stubs.length === 0)
-        return { ok: false, reason: "no_directory_nodes" };
-    const fromEpochN = Number(/:epoch:(\d+)$/.exec(h.share.epochId)?.[1] ?? "1");
-    let result;
-    try {
-        result = await runNetworkRefresh(Buffer.from(deps.agentPubkeyHex, "hex"), {
-            threshold: h.share.threshold,
-            participants: h.share.participants,
-            directoryNodes: h.stubs,
-            fromEpochN,
-            signAuth: (hash) => deps.keyProvider.sign(hash), // SEC-2
-        });
-    }
-    catch (err) {
-        deps.logger.error("refresh.ceremony.failed", {
-            agentName: deps.agentName,
-            detail: extractErrorMessage(err),
-        });
-        return { ok: false, reason: "ceremony_failed" };
-    }
-    const primaryPubkeyHex = Buffer.from(result.primaryPubkey).toString("hex");
-    // M2 (defense-in-depth): the group public key MUST be byte-identical to the PRE-refresh key. The
-    // cross-node check inside runNetworkRefresh only proves all parties AGREE post-refresh — a uniform
-    // secret-shift (a crypto-core regression) would move the key on every party identically and pass it,
-    // while silently diverging from the registered key counterparties verify seals against. Assert against
-    // the KNOWN pre-refresh key (h.share.primaryPubkey) and abort WITHOUT persisting on mismatch.
-    if (primaryPubkeyHex !== h.share.primaryPubkey) {
-        deps.logger.error("refresh.ceremony.group_key_changed", {
-            agentName: deps.agentName,
-            expected: h.share.primaryPubkey.slice(0, 16),
-            got: primaryPubkeyHex.slice(0, 16),
-        });
-        return { ok: false, reason: "group_key_changed" };
-    }
-    // verifyingShares are PUBLIC (s_j·G per participant) and MOVE on a real refresh while commitments[0]
-    // (the group key) does not — so their digest is the one observable that distinguishes a genuine
-    // rotation from a no-op "relabel" (the spine asserts it changes across two refreshes). SI-001-safe.
-    const verifyingSharesDigest = createHash("sha256")
-        .update(Object.keys(result.verifyingShares)
-        .sort()
-        .map((k) => `${k}:${Buffer.from(result.verifyingShares[k]).toString("hex")}`)
-        .join("|"))
-        .digest("hex");
-    // L7: a persist failure here is the most dangerous point (directories already advanced) — surface it
-    // as a STRUCTURED reason rather than letting a raw throw escape the handler.
-    try {
-        await deps.persistence.persistFrostKeyShare({
-            epochId: `${deps.agentPubkeyHex}:epoch:${result.toEpochN}`,
-            primaryPubkey: primaryPubkeyHex,
-            identifier: result.identifier,
-            signingShare: result.signingShare,
-            threshold: h.share.threshold,
-            participants: h.share.participants,
-            commitmentsCbor: encodeCbor(result.commitments),
-            verifyingSharesCbor: encodeCbor(result.verifyingShares),
-            dkgMethod: "network_dkg",
-            // M8B quorum: a proactive refresh re-randomizes shares among the SAME membership — carry the
-            // quorum Q forward, else this UPDATE wipes frost_directory_node_ids to NULL and the next restart's
-            // seal falls back to the full roster (reintroducing the padding/retry-budget bug the persist fixed).
-            directoryNodeIds: h.share.directoryNodeIds,
-        });
-    }
-    catch (err) {
-        deps.logger.error("refresh.ceremony.persist_failed", {
-            agentName: deps.agentName,
-            detail: extractErrorMessage(err),
-        });
-        return { ok: false, reason: "persist_failed" };
-    }
-    deps.logger.info("refresh.ceremony.complete", {
-        agentName: deps.agentName,
-        toEpoch: result.toEpochN,
-        primaryPubkey: primaryPubkeyHex.slice(0, 16),
-    });
-    return { ok: true, toEpochN: result.toEpochN, primaryPubkey: primaryPubkeyHex, verifyingSharesDigest };
-}
-/**
- * Register a `ceremony_request` handler on the agent's signaling seam. On the directory's
- * delegated-signing request, run the agent's threshold signer's participateInCeremony and
- * reply with `ceremony_result`. The signer is reconstructed lazily and cached. Returns the
- * unregister function. SI-001: tbs/signature never logged.
- */
-/**
- * DOD-SPINE-7: register a `seal_verified` handler on the agent's signaling seam. After the
- * directory rebuilds + verifies the bilateral seal's signed Merkle chain (relay-mediated
- * processSeal FROST path), it sends the SEAL INITIATOR a `seal_verified` {session_id,
- * sealed_root, leaf_count, timestamp} and waits for the initiator to COORDINATE the seal FROST
- * ceremony. This handler reconstructs the agent's threshold signer (same machinery as the
- * session ceremony), runs participateInCeremony over buildSealTbs with context
- * "cello-frost-seal-v1", and replies `seal_frost_signature` {session_id, frost_signature}. The
- * directory's #processSealFrostSignature then completes notarization and delivers
- * `session_sealed` (the byte-identical sealed_root) to both parties.
- *
- * SI-001: tbs/signature never logged.
- */
-export function wireSealCeremonyHandler(deps) {
-    return deps.signaling.registerInboundHandler((frame) => {
-        if (frame["type"] !== "seal_verified")
-            return;
-        void (async () => {
-            const toU8 = (v) => v instanceof Uint8Array ? v : Buffer.isBuffer(v) ? new Uint8Array(v) : null;
-            const sessionId = toU8(frame["session_id"]);
-            const sealedRoot = toU8(frame["sealed_root"]);
-            const leafCountRaw = frame["leaf_count"];
-            const leafCount = typeof leafCountRaw === "number" ? leafCountRaw : null;
-            const tsRaw = frame["timestamp"];
-            const timestamp = typeof tsRaw === "number" ? tsRaw : typeof tsRaw === "bigint" ? Number(tsRaw) : null;
-            if (!sessionId || !sealedRoot || leafCount === null || timestamp === null) {
-                deps.logger.warn("session.seal.ceremony.abort", {
-                    agentName: deps.agentName,
-                    reason: !sessionId ? "no_session_id" : !sealedRoot ? "no_sealed_root" : leafCount === null ? "no_leaf_count" : "no_timestamp",
-                });
-                return;
-            }
-            const sidHex = Buffer.from(sessionId).toString("hex");
-            /**
-             * DOD-M15-SEALPARTIES-1: forward the raw signed leaves to every co-signing directory.
-             *
-             * They arrive on `seal_verified` and are already re-verified on this side (the frontier
-             * re-derivation below reads the same array). Forwarding them is what lets a node that did NOT
-             * run the verification rebuild the root itself and refuse a certificate over a leaf set the
-             * participants never produced — the difference between three signatures that mean three
-             * independent judgements and three that rest on one node's reading.
-             *
-             * Absent here means the frame carried none, and the directories refuse on that: it is not
-             * this side's place to decide the evidence was optional.
-             */
-            const sealEvidenceLeaves = Array.isArray(frame["frontier_leaves"]) && frame["frontier_leaves"].length > 0
-                ? frame["frontier_leaves"]
-                : undefined;
-            // Reconstruct a FRESH signer per ceremony (same rationale as the session ceremony:
-            // fresh directory endpoint, no shared FROST state across concurrent ceremonies).
-            /**
-             * ⚠️ ABSENT IS PASSED AS ABSENT — fallback hunt, finding 4. This used to send `[]`, which the
-             * co-signer classified as MALFORMED ("compare builds") rather than MISSING ("someone is asking
-             * for a signature without showing the record"). The seal failed either way; the diagnosis the
-             * module exists to produce was the one case it could never reach.
-             */
-            /**
-             * Review F6: what each holder SAID, kept so the recorded failure can name it. "Threshold not
-             * met" is a count; `SEAL_ROOT_UNSUPPORTED` from a holder is an accusation against the
-             * verifying directory, and the operator surface should be able to tell them apart.
-             */
-            const cosignRefusals = new Set();
-            const signer = await reconstructThresholdSigner(deps, sealEvidenceLeaves
-                ? { leaves: sealEvidenceLeaves, closeTimestamp: timestamp, onRefused: (r) => cosignRefusals.add(r) }
-                : undefined);
-            if (!signer) {
-                deps.logger.warn("session.seal.ceremony.abort", { agentName: deps.agentName, sessionId: sidHex, reason: "no_signer" });
-                deps.recordSealFailure(deps.agentName, sidHex, "seal_ceremony_no_signer", "unresolved");
-                return;
-            }
-            // M7 legibility-TBS-binding: when the directory's seal_verified carries `legibility` (the
-            // bilateral seal), fold its canonical hash into the TBS we co-sign — so the FROST signature
-            // covers the legibility and a MITM cannot tamper answered/frontier/attestation_mode in
-            // transit. The directory binds the IDENTICAL hash (it built the TBS it verifies against);
-            // the receiving client re-binds and verifies. Unilateral seal_verified carries no legibility
-            // → plain TBS (bindLegibilityToTbs is a no-op), matching the directory's unilateral TBS.
-            const legibility = frame["legibility"];
-            const legForHash = legibility && typeof legibility === "object" ? legibility : null;
-            // DOD-LEG-2 (SI-002): the INITIATOR must not co-sign an inflated certificate — otherwise a
-            // validly-FROST-signed inflated cert would exist as a durable artifact. Re-derive each party's
-            // content_frontier_seq from the signed leaves the directory ships on seal_verified and ABORT
-            // the ceremony (no signature) if any published frontier is inflated. Same logic the receiver
-            // applies at session_sealed; doing it here means a lying directory gets NO signature at all.
-            const wireParts = legForHash && Array.isArray(legForHash.participants)
-                ? (legForHash.participants)
-                : null;
-            if (wireParts) {
-                // Wire pubkeys are Uint8Array; normalise to hex for comparison with the re-derived map.
-                const parts = wireParts.map((p) => ({
-                    pubkey: p.pubkey instanceof Uint8Array
-                        ? Buffer.from(p.pubkey).toString("hex")
-                        : (typeof p.pubkey === "string" ? p.pubkey : null),
-                    content_frontier_seq: typeof p.content_frontier_seq === "number" ? p.content_frontier_seq : null,
-                }));
-                const malformed = parts.some((p) => p.pubkey === null || p.content_frontier_seq === null);
-                const anyClaimed = parts.some((p) => (p.content_frontier_seq ?? 0) > 0);
-                const flRaw = frame["frontier_leaves"];
-                const haveLeaves = Array.isArray(flRaw) && flRaw.length > 0;
-                if (malformed || (anyClaimed && !haveLeaves)) {
-                    const abortReason = malformed ? "frontier_participant_malformed" : "frontier_leaves_missing";
-                    deps.logger.warn("session.seal.ceremony.abort", {
-                        agentName: deps.agentName, sessionId: sidHex, reason: abortReason,
-                    });
-                    deps.recordSealFailure(deps.agentName, sidHex, abortReason, "unresolved");
-                    return;
-                }
-                if (haveLeaves) {
-                    const toLeaf = (v) => (v instanceof Uint8Array ? v : new Uint8Array(v));
-                    const leaves = flRaw.map((l) => {
-                        const o = l;
-                        return { structure1_cbor: toLeaf(o["structure1_cbor"]), sender_pubkey: toLeaf(o["sender_pubkey"]), sender_signature: toLeaf(o["sender_signature"]) };
-                    });
-                    const rederived = reDeriveFrontiers(leaves, sessionId);
-                    const inflated = rederived.ok
-                        ? findInflatedFrontier(parts, rederived.frontiers)
-                        : null;
-                    if (!rederived.ok || inflated) {
-                        const inflatedReason = rederived.ok ? "frontier_unverifiable" : rederived.reason;
-                        deps.logger.warn("session.seal.ceremony.abort", {
-                            agentName: deps.agentName, sessionId: sidHex,
-                            reason: inflatedReason,
-                            ...(inflated ? { party: inflated.party, publishedFrontier: inflated.publishedFrontier, derivedFrontier: inflated.derivedFrontier } : {}),
-                        });
-                        deps.recordSealFailure(deps.agentName, sidHex, inflatedReason, "unresolved");
-                        return; // refuse to co-sign — the directory gets no signature for an inflated cert
-                    }
-                }
-            }
-            /**
-             * DO NOT SIGN A ROOT THIS AGENT HAS NOT CHECKED — bullet 2's co-signing half (review F1).
-             *
-             * Same predicate as the receiving path, deliberately: one implementation, so the two halves
-             * cannot drift into disagreeing about what counts as a mismatch.
-             *
-             * `cannot_judge` REFUSES here, where the accept path tolerates it — and the asymmetry is the
-             * point. Accepting an unverifiable certificate keeps a receipt that already exists; SIGNING an
-             * unverifiable one manufactures a new, durable, non-repudiable claim with this agent's key on
-             * it. The safe default is opposite in each direction: tolerate on the way in, refuse on the way
-             * out.
-             */
-            // The evidence travels too: a side that restarted mid-session can never receive the counterparty's
-            // SEAL leaf, but the request it is being asked to sign already carries it, signed.
-            const rootCheck = deps.verifyCertifiedRoot(deps.agentPubkeyHex, sidHex, sealedRoot, leafCount, sealEvidenceLeaves);
-            if (rootCheck.verdict !== "match") {
-                deps.logger.error("session.seal.ceremony.abort", {
-                    agentName: deps.agentName, sessionId: sidHex,
-                    reason: rootCheck.verdict === "mismatch" ? "root_mismatch" : "root_unverifiable",
-                    detail: rootCheck.verdict === "mismatch" ? rootCheck.detail : rootCheck.reason,
-                    ...(rootCheck.verdict === "mismatch" && rootCheck.ownRootHex ? { ownRoot: rootCheck.ownRootHex } : {}),
-                    impact: "this agent REFUSED to co-sign. Signing would have put its key on a notarization it " +
-                        "cannot confirm describes this conversation — a durable, valid, non-repudiable claim " +
-                        "about a transcript it never checked. The session is not sealed; nothing is lost.",
-                    guidance: "Compare the leaf count with the counterparty and check the directory and relay logs for " +
-                        "this session id. Do NOT force-abandon: that forfeits the receipt permanently.",
-                });
-                deps.recordSealFailure(deps.agentName, sidHex, rootCheck.verdict === "mismatch" ? "seal_root_mismatch" : "seal_root_unverifiable", "unresolved");
-                return; // refuse to co-sign — the directory gets no signature for a root we cannot verify
-            }
-            const tbs = bindLegibilityToTbs(buildSealTbs(sessionId, sealedRoot, leafCount, timestamp), legForHash);
-            let frostSignature = null;
-            try {
-                // The initiator COORDINATES the seal FROST ceremony (its signer drives the
-                // /cello/frost round-trips with the directory's K_server shares via directoryNodeStubs).
-                const result = await signer.participateInCeremony(`seal:${sidHex}`, tbs, "cello-frost-seal-v1");
-                frostSignature = result.ok ? new Uint8Array(result.signature) : null;
-                deps.logger.info("session.seal.ceremony.participated", { agentName: deps.agentName, sessionId: sidHex, ok: result.ok });
-            }
-            catch (err) {
-                deps.logger.warn("session.seal.ceremony.failed", {
-                    agentName: deps.agentName,
-                    sessionId: sidHex,
-                    detail: extractErrorMessage(err),
-                });
-                deps.recordSealFailure(deps.agentName, sidHex, "seal_ceremony_threw", "unresolved");
-                return;
-            }
-            if (!frostSignature) {
-                /**
-                 * ⚠️ THIS WAS `if (!frostSignature) return;` WITH NO LOG AND NO RECORD —
-                 * `DOD-M15-SEALPARTIES-1`.
-                 *
-                 * It is where a seal lands when the FROST ceremony produces nothing, and requiring the
-                 * co-signing directories to judge the leaves makes it reachable for a NEW and important
-                 * reason: a holder looked at the record, decided it does not support the root, and declined.
-                 * That is the strongest signal this system produces, and its entire trace was a bare return.
-                 *
-                 * The refusing node's own reason is on the coordinating side too — `network-directory-node`
-                 * logs `frost.directory.sign.refused` per node with what that node said — because a
-                 * threshold failure is a count, and the count does not say WHY any particular holder said
-                 * no.
-                 */
-                deps.logger.error("session.seal.ceremony.no_signature", {
-                    agentName: deps.agentName,
-                    sessionId: sidHex,
-                    cosignRefusals: [...cosignRefusals].sort(),
-                    impact: "the seal FROST ceremony ended with no signature, so this session has no certificate " +
-                        "and nothing was signed with this agent's key. Enough share-holding directories " +
-                        "declined or were unreachable that the threshold was not met.",
-                    guidance: "Look for frost.directory.sign.refused in this daemon's log — each line names one " +
-                        "directory and the reason it gave. A SEAL_ROOT_UNSUPPORTED there means a holder rebuilt " +
-                        "the root from the leaves and got a different answer, which is a fault in the verifying " +
-                        "directory or the relay, not in this agent. Do NOT force-abandon: that forfeits the " +
-                        "receipt permanently.",
-                });
-                deps.recordSealFailure(deps.agentName, sidHex, cosignRefusals.size > 0
-                    ? `seal_cosigners_refused:${[...cosignRefusals].sort().join(",")}`
-                    : "seal_ceremony_threshold_not_met", "unresolved");
-                return;
-            }
-            await sendSealFrostSignature(deps, sessionId, sidHex, frostSignature);
-        })();
-    });
-}
-/**
- * DOD-SENDRAW-1: deliver the co-signed seal FROST signature to the directory, branching on the
- * seam's RESOLVED result. The production seam (transport SignalingManager.sendRaw) never throws —
- * it resolves {ok:false, reason} on every failure — so the old try/catch logged `.sent` for a
- * signature that never left the machine, inside the non-repudiation ceremony, and the failure
- * event was unreachable. Exported so the send contract is testable without a live FROST ceremony.
- */
-export async function sendSealFrostSignature(deps, sessionId, sidHex, frostSignature) {
-    try {
-        const res = await deps.signaling.sendRaw({ type: "seal_frost_signature", session_id: sessionId, frost_signature: frostSignature });
-        if (res.ok) {
-            deps.logger.info("session.seal.frost.signature.sent", { agentName: deps.agentName, sessionId: sidHex });
-        }
-        else {
-            deps.logger.warn("session.seal.frost.signature.send.failed", {
-                agentName: deps.agentName,
-                sessionId: sidHex,
-                detail: res.reason ?? "send_not_ok",
-                ...(res.guidance ? { guidance: res.guidance } : {}),
-            });
-        }
-    }
-    catch (err) {
-        deps.logger.warn("session.seal.frost.signature.send.failed", {
-            agentName: deps.agentName,
-            sessionId: sidHex,
-            detail: extractErrorMessage(err),
-        });
-    }
-}
-/**
- * SESSION-002 (DOD-SEAL-3): verify a unilateral seal certificate WITHOUT trusting the
- * channel. Rebuilds the canonical seal TBS from the cert fields and verifies the signature
- * against a key trusted independently of the delivering frame: the session primary_pubkey
- * (commitments[0] of this agent's FROST share) for 'frost'. A channel-swapped sealed_root
- * (or any TBS-bound field) fails this check (SI-003).
- *
- * 'single' is not a second variant this function is missing — it is a DOWNGRADE, refused by name
- * before a session exists (`assignment_signature_type_downgraded`, assignment-verify.ts, checked
- * against the directory's only producer of `signature_type`). A cert carrying it is a shape no
- * honest peer can produce, so the branch below refuses rather than verifying. Do not "finish" it
- * by adding a manifest-key path: that would make the downgrade verifiable instead of refused,
- * which is the outcome the upstream check exists to prevent.
- */
-export async function verifyUnilateralCertificate(deps, cert) {
-    const tbs = buildSealTbs(cert.sessionId, cert.sealedRoot, cert.leafCount, cert.closeTimestamp);
-    if (cert.signatureType !== "frost") {
-        // 'single' is a DOWNGRADE, not an unfinished path. A pre-DKG single-key assignment is refused
-        // by name upstream (`assignment_signature_type_downgraded`, assignment-verify.ts), so a cert
-        // reaching here with one is a shape that should never arrive. Refusing is the correct end state;
-        // there is nothing to wire.
-        return { ok: false, reason: "single_key_verification_unsupported" };
-    }
-    const share = await deps.persistence.loadActiveFrostKeyShare();
-    if (!share)
-        return { ok: false, reason: "no_frost_share" };
-    let primaryPubkey = null;
-    try {
-        const dc = decode(Buffer.from(share.commitmentsCbor));
-        if (Array.isArray(dc) && dc.length > 0) {
-            const c0 = dc[0];
-            primaryPubkey = c0 instanceof Uint8Array ? c0 : Buffer.isBuffer(c0) ? new Uint8Array(c0) : null;
-        }
-    }
-    catch (err) {
-        deps.logger.warn("session.unilateral.certificate.share.decode.failed", {
-            agentPubkey: deps.agentPubkeyHex,
-            detail: extractErrorMessage(err),
-        });
-        return { ok: false, reason: "share_decode_failed" };
-    }
-    if (!primaryPubkey || primaryPubkey.length !== 32)
-        return { ok: false, reason: "no_primary_pubkey" };
-    const verifier = new FrostThresholdSigner({ threshold: 1, participants: 1 }, Buffer.from(deps.agentPubkeyHex, "hex"));
-    const valid = verifier.verifySignature(cert.frostSignature, tbs, "cello-frost-seal-v1", primaryPubkey);
-    return valid ? { ok: true } : { ok: false, reason: "signature_invalid" };
-}
-/**
- * M7 legibility-TBS-binding: verify a BILATERAL session_sealed certificate's signature over the
- * legibility-bound TBS, channel-independently.
- *
- * KEY STRUCTURE (why verifiability is asymmetric TODAY): the seal's FROST signature is produced by
- * the group key (commitments[0] of the DKG share) of whichever party CLOSED THE SESSION FIRST — the
- * directory designates the sender of the first SEAL ctrl leaf as the "seal initiator" and signs
- * against that party's primary (directory-node.ts). This is NOT a fixed initiator/responder role:
- * either the session initiator or the responder can be the first closer.
- *
- * A party can channel-independently verify here only against a group primary it HOLDS locally:
- *  - its OWN primary — loaded from its own DKG share (`signer_pubkey === own primary`); or
- *  - the counterparty's primary — recorded via recordCounterpartyPrimary (see below).
- * It then verifies the FROST signature over `buildSealTbs ‖ legibilityHash`. A tampered legibility
- * (answered / content_frontier_seq / attestation_mode — carried unsigned on the frame) changes the
- * hash → the signature fails → REJECT.
- *
- * When the signer's key is NOT held locally, the party ACCEPTS (`verified:false`, with a `reason`).
- * This is sound for the LIVE path: session_sealed arrives over the daemon↔directory libp2p Noise
- * channel (authenticated + encrypted), so it is not MITM-tamperable in transit; the binding's
- * primary value is OUT-OF-BAND (any holder of the signer's primary — e.g. an arbitrator — can verify
- * an exported cert's legibility).
- *
- * SYMMETRY: both closing orders verify locally, and it takes BOTH bindings to stay that way. The
- * initiator learns the responder's primary from `participant_b_primary_pubkey` with a binding
- * signed by participant_b's own K_local, recorded by `initiate-session-handler.ts`; the responder
- * learns the initiator's from `signer_pubkey` with `participant_a_key_binding`, verified before the
- * assignment's threshold signature is checked at all and recorded by `inbound-sessions.ts`. Both
- * are refused by name when absent or invalid (`assignment-verify.ts`).
- *
- * The binding, not the key, is the load-bearing part: carrying a group key alone would let a
- * directory name one of its choosing, so a change that keeps either key and drops its binding
- * breaks verification while appearing to work.
- *
- * `signer_key_not_held` is therefore NOT the ordinary responder-first outcome. It remains reachable
- * for a session row that predates the recording, or one whose assignment never reached this path,
- * and it is the honest answer there, which is why the branch stays.
- *
- * `legibility` MUST be the AS-RECEIVED wire object (not a normalised copy) — the directory signed
- * over the canonical hash of exactly what it sent.
- */
-export async function verifyBilateralSealCertificate(deps, cert) {
-    // F2-a: every verified:false branch carries a `reason` so the daemon's
-    // session.sealed.signature.checked log can never read as a silently-tolerated FAILED check.
-    // A genuinely failed check takes the { ok:false, reason:"signature_invalid" } path, which the
-    // caller REJECTS (never marks sealed). verified:false is always "no key held to verify → accepted
-    // on the authenticated Noise channel", never "a check ran and failed".
-    if (cert.signatureType !== "frost")
-        return { ok: true, verified: false, reason: "non_frost_certificate" };
-    if (cert.signerPubkey.length !== 32)
-        return { ok: false, reason: "no_signer_pubkey" };
-    const signerHex = Buffer.from(cert.signerPubkey).toString("hex");
-    const share = await deps.persistence.loadActiveFrostKeyShare();
-    if (!share)
-        return { ok: true, verified: false, reason: "no_frost_share" }; // no share to verify with — accept (Noise-delivered)
-    let ownPrimary = null;
-    try {
-        const dc = decode(Buffer.from(share.commitmentsCbor));
-        if (Array.isArray(dc) && dc.length > 0) {
-            const c0 = dc[0];
-            ownPrimary = c0 instanceof Uint8Array ? c0 : Buffer.isBuffer(c0) ? new Uint8Array(c0) : null;
-        }
-    }
-    catch {
-        return { ok: true, verified: false, reason: "commitments_decode_failed" };
-    }
-    if (!ownPrimary || ownPrimary.length !== 32)
-        return { ok: true, verified: false, reason: "own_primary_unavailable" };
-    // The seal is signed by the INITIATOR's primary (group) key. This party can verify against a
-    // key it holds independently: its OWN primary (when it is the initiator) or the counterparty's
-    // primary from the FROST-signed SessionAssignment (when it is the responder). SI-003: the signer
-    // must be one of these — never a key supplied only by the (untrusted) cert frame.
-    const cpHex = deps.counterpartyPrimaryHex ?? null;
-    if (signerHex === Buffer.from(ownPrimary).toString("hex")) {
-        // initiator path — verify against own primary.
-    }
-    else if (cpHex && signerHex === cpHex.toLowerCase()) {
-        // responder path — verify against the known counterparty primary.
-    }
-    else if (cpHex) {
-        // We know the counterparty primary and the signer is NEITHER participant → unknown signer.
-        return { ok: false, reason: "signer_not_a_session_participant" };
-    }
-    else {
-        // We do not hold the signer's key (no counterparty primary recorded) → cannot verify; accept
-        // (the live frame arrived over the authenticated Noise channel; the binding aids out-of-band).
-        // Reachable only for a session whose assignment never carried (or never recorded) the
-        // counterparty's bound primary — a pre-038-KEYBIND row. A CURRENT session reaching here means
-        // `recordCounterpartyPrimary` did not run on either side (`initiate-session-handler.ts` for the
-        // initiator, `inbound-sessions.ts` for the responder), which is a defect, not a close order.
-        return { ok: true, verified: false, reason: "signer_key_not_held" };
-    }
-    const tbs = bindLegibilityToTbs(buildSealTbs(cert.sessionId, cert.sealedRoot, cert.leafCount, cert.closeTimestamp), cert.legibility);
-    const verifier = new FrostThresholdSigner({ threshold: 1, participants: 1 }, Buffer.from(deps.agentPubkeyHex, "hex"));
-    const valid = verifier.verifySignature(cert.frostSignature, tbs, "cello-frost-seal-v1", cert.signerPubkey);
-    return valid ? { ok: true, verified: true } : { ok: false, reason: "signature_invalid" };
-}
-export function wireSessionCeremonyHandler(deps) {
-    return deps.signaling.registerInboundHandler((frame) => {
-        if (frame["type"] !== "ceremony_request")
-            return;
-        void (async () => {
-            const ceremonyId = typeof frame["ceremony_id"] === "string" ? frame["ceremony_id"] : undefined;
-            const tbsRaw = frame["tbs"];
-            const tbs = tbsRaw instanceof Uint8Array ? tbsRaw : Buffer.isBuffer(tbsRaw) ? new Uint8Array(tbsRaw) : null;
-            const context = typeof frame["context"] === "string" ? frame["context"] : undefined;
-            // L3: the reply send is best-effort — a throw here must not become an unhandled
-            // rejection in this fire-and-forget handler. DOD-SENDRAW-1: the production seam never
-            // throws — it resolves {ok:false, reason} — so the failure must be read off the RESULT;
-            // catch-only made session.ceremony.reply.failed unreachable in production.
-            const reply = async (signature) => {
-                if (!ceremonyId)
-                    return;
-                try {
-                    const res = await deps.signaling.sendRaw({ type: "ceremony_result", ceremony_id: ceremonyId, signature });
-                    if (!res.ok) {
-                        deps.logger.warn("session.ceremony.reply.failed", {
-                            agentName: deps.agentName,
-                            detail: res.reason ?? "send_not_ok",
-                            ...(res.guidance ? { guidance: res.guidance } : {}),
-                        });
-                    }
-                }
-                catch (err) {
-                    deps.logger.warn("session.ceremony.reply.failed", {
-                        agentName: deps.agentName,
-                        detail: extractErrorMessage(err),
-                    });
-                }
-            };
-            // L1: a request with no addressable ceremony_id cannot be replied to (the reply is
-            // keyed by it) — log and drop rather than send an unkeyed result.
-            if (!ceremonyId) {
-                deps.logger.warn("session.ceremony.abort", { agentName: deps.agentName, reason: "no_ceremony_id" });
-                return;
-            }
-            if (!tbs || !context) {
-                deps.logger.warn("session.ceremony.abort", { agentName: deps.agentName, reason: !tbs ? "no_tbs" : "no_context" });
-                await reply(null);
-                return;
-            }
-            // H1 / M1 / concurrency: reconstruct a FRESH signer (fresh directory endpoint +
-            // NetworkDirectoryNode) PER ceremony. No caching — so signaling reconnecting to a
-            // different directory node is picked up, a transient reconstruction failure retries
-            // on the next request, and concurrent ceremonies never share one signer's FROST
-            // state. (storeDkgResult is idempotent for the same share; reconstruction is cheap.)
-            const signer = await reconstructThresholdSigner(deps);
-            if (!signer) {
-                deps.logger.warn("session.ceremony.abort", { agentName: deps.agentName, reason: "no_signer" });
-                await reply(null);
-                return;
-            }
-            try {
-                const result = await signer.participateInCeremony(ceremonyId, tbs, context);
-                deps.logger.info("session.ceremony.participated", {
-                    agentName: deps.agentName,
-                    ceremonyId: ceremonyId.slice(0, 16),
-                    ok: result.ok,
-                });
-                await reply(result.ok ? new Uint8Array(result.signature) : null);
-            }
-            catch (err) {
-                deps.logger.warn("session.ceremony.failed", {
-                    agentName: deps.agentName,
-                    detail: extractErrorMessage(err),
-                });
-                await reply(null);
-            }
-        })();
-    });
-}
-//# sourceMappingURL=session-ceremony.js.map