@openzeppelin/miden-multisig-client 0.16.2 → 0.17.0-rc.2

package/dist/multisig.test.js

@@ -1,13 +1,24 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { Multisig } from './multisig.js';
 import { GuardianHttpClient } from '@openzeppelin/guardian-client';
-import { buildUpdateProcedureThresholdTransactionRequest, buildUpdateGuardianTransactionRequest, buildUpdateSignersTransactionRequest, executeForSummary, } from './transaction.js';
-const { mockRpcGetAccountDetails, mockAccountDeserialize, mockDetectConfig, mockNoteFileDeserialize } = vi.hoisted(() => ({
+import { buildUpdateProcedureThresholdTransactionRequest, buildUpdateGuardianTransactionRequest, buildUpdateSignersTransactionRequest, chainAnchorFromBase64, executeForSummary, executeForSummaryAt, } from './transaction.js';
+const { mockRpcGetAccountDetails, mockAccountDeserialize, mockDetectConfig, mockNoteFileDeserialize, mockGetSignerCommitments, mockGetGuardianCommitment, } = vi.hoisted(() => ({
     mockRpcGetAccountDetails: vi.fn(),
     mockAccountDeserialize: vi.fn(),
     mockDetectConfig: vi.fn(),
     mockNoteFileDeserialize: vi.fn(),
+    mockGetSignerCommitments: vi.fn(),
+    mockGetGuardianCommitment: vi.fn(),
 }));
+const { MOCK_CHAIN_ANCHOR_B64, createMockChainAnchor } = vi.hoisted(() => {
+    const MOCK_CHAIN_ANCHOR_B64 = 'bW9jay1jaGFpbi1hbmNob3I=';
+    const createMockChainAnchor = () => ({
+        commitment: () => ({ toHex: () => '0x' + 'b'.repeat(64) }),
+        free: () => { },
+        serialize: () => new Uint8Array([9, 9, 9]),
+    });
+    return { MOCK_CHAIN_ANCHOR_B64, createMockChainAnchor };
+});
 // Mock the Miden SDK
 vi.mock('@miden-sdk/miden-sdk', () => ({
     Account: {
@@ -33,9 +44,10 @@ vi.mock('@miden-sdk/miden-sdk', () => ({
             toCommitment: () => ({
                 toHex: () => '0x' + 'c'.repeat(64),
             }),
-            salt: () => ({
-                toHex: () => '0x' + 'd'.repeat(64),
+            blockCommitment: () => ({
+                toHex: () => '0x' + 'b'.repeat(64),
             }),
+            userParams: () => [0, 0, 0, 1, 2, 3, 4],
             serialize: () => new Uint8Array([1, 2, 3]),
         }),
     },
@@ -70,6 +82,12 @@ vi.mock('@miden-sdk/miden-sdk', () => ({
 // Mock transaction module
 vi.mock('./transaction.js', () => ({
     executeForSummary: vi.fn(),
+    executeForSummaryAt: vi.fn(),
+    chainAnchorToBase64: vi.fn(() => MOCK_CHAIN_ANCHOR_B64),
+    chainAnchorFromBase64: vi.fn(() => createMockChainAnchor()),
+    summarySalt: vi.fn(() => ({
+        toHex: () => '0x' + 'd'.repeat(64),
+    })),
     buildUpdateSignersTransactionRequest: vi.fn().mockResolvedValue({
         request: {},
         salt: { toHex: () => '0x' + 'd'.repeat(64) },
@@ -115,6 +133,9 @@ vi.mock('./utils/signature.js', async () => {
             values: [1, 2, 3],
         })),
         signatureHexToBytes: vi.fn((hex) => new Uint8Array([0, 1, 2, 3])),
+        // These tests use synthetic signature bytes to exercise advice routing;
+        // recoverability is covered by tests/ecdsa-advice-encoding.test.ts.
+        assertEcdsaSignatureRecoverable: vi.fn(),
     };
 });
 vi.mock('./utils/encoding.js', async () => {
@@ -124,11 +145,19 @@ vi.mock('./utils/encoding.js', async () => {
         normalizeHexWord: vi.fn((hex) => '0x' + hex.replace(/^0x/i, '').toLowerCase().padStart(64, '0')),
     };
 });
-vi.mock('./inspector.js', () => ({
-    AccountInspector: {
-        fromAccount: mockDetectConfig,
-    },
-}));
+// Keep the real assertCompleteDetectedConfig so refreshConfigFromAccount's
+// fail-closed validation is exercised.
+vi.mock('./inspector.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        AccountInspector: {
+            fromAccount: mockDetectConfig,
+            getSignerPublicKeyCommitments: mockGetSignerCommitments,
+            getGuardianPublicKeyCommitment: mockGetGuardianCommitment,
+        },
+    };
+});
 // Mock fetch for GUARDIAN client
 const mockFetch = vi.fn();
 vi.stubGlobal('fetch', mockFetch);
@@ -157,6 +186,15 @@ describe('Multisig', () => {
     beforeEach(() => {
         mockFetch.mockReset();
         vi.mocked(executeForSummary).mockResolvedValue({
+            summary: {
+                toCommitment: () => ({
+                    toHex: () => '0x' + 'c'.repeat(64),
+                }),
+                serialize: () => new Uint8Array([1, 2, 3]),
+            },
+            anchor: createMockChainAnchor(),
+        });
+        vi.mocked(executeForSummaryAt).mockResolvedValue({
             toCommitment: () => ({
                 toHex: () => '0x' + 'c'.repeat(64),
             }),
@@ -175,7 +213,6 @@ describe('Multisig', () => {
             threshold: 1,
             numSigners: 1,
             signerCommitments: ['0x' + 'a'.repeat(64)],
-            guardianEnabled: true,
             guardianCommitment: '0x' + 'c'.repeat(64),
             vaultBalances: [],
             procedureThresholds: new Map(),
@@ -291,6 +328,34 @@ describe('Multisig', () => {
             expect(multisig.accountId).toBe(accountId);
         });
     });
+    describe('history (issue #413)', () => {
+        it('delegates to the guardian client with the account id and options', async () => {
+            const config = {
+                threshold: 1,
+                signerCommitments: ['0x' + 'a'.repeat(64)],
+                guardianCommitment: '0x' + 'c'.repeat(64),
+            };
+            const multisig = createTestMultisig(config);
+            const page = {
+                entries: [
+                    {
+                        nonce: 3,
+                        status: 'canonical',
+                        timestamp: '2026-08-01T12:00:03Z',
+                        newCommitment: '0x' + 'b'.repeat(64),
+                        inputNotes: [],
+                        outputNotes: [],
+                        decodeWarnings: [],
+                    },
+                ],
+                nextCursor: 'cursor-token',
+            };
+            const spy = vi.spyOn(guardian, 'getDeltaHistory').mockResolvedValue(page);
+            const result = await multisig.deltaHistory({ limit: 5, cursor: 'prev' });
+            expect(result).toBe(page);
+            expect(spy).toHaveBeenCalledWith('0x' + 'a'.repeat(30), { limit: 5, cursor: 'prev' });
+        });
+    });
     describe('signerCommitment', () => {
         it('should return signer commitment', () => {
             const config = {
@@ -302,6 +367,45 @@ describe('Multisig', () => {
             expect(multisig.signerCommitment).toBe(mockSigner.commitment);
         });
     });
+    describe('getSignerPublicKeyCommitments (issue #306)', () => {
+        const config = {
+            threshold: 1,
+            signerCommitments: ['0x' + 'a'.repeat(64)],
+            guardianCommitment: '0x' + 'c'.repeat(64),
+        };
+        it('reads commitments from the store-backed account', async () => {
+            const storeAccount = mockedAccount('0x' + 'b'.repeat(64), 1);
+            mockWebClient.getAccount.mockResolvedValueOnce(storeAccount);
+            const expected = ['0x' + '1'.repeat(64), '0x' + '2'.repeat(64)];
+            mockGetSignerCommitments.mockReturnValueOnce(expected);
+            const multisig = createTestMultisig(config);
+            const commitments = await multisig.getSignerPublicKeyCommitments();
+            expect(commitments).toEqual(expected);
+            expect(mockGetSignerCommitments).toHaveBeenCalledWith(storeAccount);
+        });
+        it('falls back to the account snapshot when the store has no record', async () => {
+            mockWebClient.getAccount.mockResolvedValueOnce(null);
+            mockGetSignerCommitments.mockReturnValueOnce(['0x' + '3'.repeat(64)]);
+            const multisig = createTestMultisig(config);
+            await multisig.getSignerPublicKeyCommitments();
+            expect(mockGetSignerCommitments).toHaveBeenCalledWith(mockAccount);
+        });
+    });
+    describe('getGuardianPublicKeyCommitment (issue #306)', () => {
+        it('reads the guardian commitment from the store-backed account', async () => {
+            const storeAccount = mockedAccount('0x' + 'b'.repeat(64), 1);
+            mockWebClient.getAccount.mockResolvedValueOnce(storeAccount);
+            mockGetGuardianCommitment.mockReturnValueOnce('0x' + '4'.repeat(64));
+            const multisig = createTestMultisig({
+                threshold: 1,
+                signerCommitments: ['0x' + 'a'.repeat(64)],
+                guardianCommitment: '0x' + 'c'.repeat(64),
+            });
+            const commitment = await multisig.getGuardianPublicKeyCommitment();
+            expect(commitment).toBe('0x' + '4'.repeat(64));
+            expect(mockGetGuardianCommitment).toHaveBeenCalledWith(storeAccount);
+        });
+    });
     describe('fetchState', () => {
         it('should fetch account state from GUARDIAN', async () => {
             const config = {
@@ -397,7 +501,6 @@ describe('Multisig', () => {
                 threshold: 2,
                 numSigners: 2,
                 signerCommitments: ['0x' + '1'.repeat(64), '0x' + '2'.repeat(64)],
-                guardianEnabled: true,
                 guardianCommitment: '0x' + 'd'.repeat(64),
                 vaultBalances: [],
                 procedureThresholds: new Map(),
@@ -411,6 +514,40 @@ describe('Multisig', () => {
             expect(multisig.guardianCommitment).toBe('0x' + 'd'.repeat(64));
             expect(mockWebClient.newAccount).not.toHaveBeenCalled();
         });
+        it('keeps the previous config when a refresh reads an incomplete signer set (issue #306 review)', async () => {
+            const config = {
+                threshold: 1,
+                signerCommitments: ['0x' + 'a'.repeat(64)],
+                guardianCommitment: '0x' + 'c'.repeat(64),
+            };
+            const multisig = createTestMultisig(config, mockSigner, '0x' + 'a'.repeat(30));
+            mockWebClient.getAccount.mockResolvedValueOnce(mockedAccount('0x' + 'b'.repeat(64), 0));
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({
+                    account_id: multisig.accountId,
+                    commitment: '0x' + 'b'.repeat(64),
+                    state_json: { data: 'AQID' },
+                    created_at: '2024-01-01T00:00:00Z',
+                    updated_at: '2024-01-02T00:00:00Z',
+                }),
+            });
+            // Storage reports 3 signers but only 1 entry was readable: adopting
+            // this would let membership proposals rewrite the on-chain set without
+            // the omitted keys. The refresh must keep the previous config instead.
+            mockDetectConfig.mockReturnValueOnce({
+                threshold: 2,
+                numSigners: 3,
+                signerCommitments: ['0x' + '1'.repeat(64)],
+                guardianCommitment: '0x' + 'd'.repeat(64),
+                vaultBalances: [],
+                procedureThresholds: new Map(),
+            });
+            await multisig.syncState();
+            expect(multisig.threshold).toBe(1);
+            expect(multisig.signerCommitments).toEqual(['0x' + 'a'.repeat(64)]);
+            expect(multisig.guardianCommitment).toBe('0x' + 'c'.repeat(64));
+        });
         it('should overwrite local state when account is not found on-chain', async () => {
             const config = {
                 threshold: 1,
@@ -686,6 +823,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
                             description: '',
@@ -731,6 +869,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
                             description: '',
@@ -777,6 +916,7 @@ describe('Multisig', () => {
                                 signatures: [],
                                 metadata: {
                                     proposal_type: 'add_signer',
+                                    chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                                     target_threshold: 1,
                                     signer_commitments: ['0x' + 'a'.repeat(64)],
                                     description: '',
@@ -792,13 +932,65 @@ describe('Multisig', () => {
                     ],
                 }),
             });
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'f'.repeat(64),
                 }),
             });
             await expect(multisig.syncProposals()).rejects.toThrow('Invalid proposal: metadata does not match tx_summary');
         });
+        /// A structurally valid anchor pinned to the wrong block must be rejected
+        /// before anything executes against it: its commitment disagrees with the
+        /// block commitment signed into the tx_summary.
+        it('should reject a proposal whose chain anchor does not match the summary block commitment', async () => {
+            const config = {
+                threshold: 1,
+                signerCommitments: ['0x' + 'a'.repeat(64)],
+                guardianCommitment: '0x' + 'c'.repeat(64),
+            };
+            const multisig = createTestMultisig(config);
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({
+                    proposals: [
+                        {
+                            account_id: '0x' + 'a'.repeat(30),
+                            nonce: 1,
+                            prev_commitment: '0x' + 'b'.repeat(64),
+                            delta_payload: {
+                                tx_summary: { data: 'AQID' },
+                                signatures: [],
+                                metadata: {
+                                    proposal_type: 'add_signer',
+                                    chain_anchor: MOCK_CHAIN_ANCHOR_B64,
+                                    target_threshold: 1,
+                                    signer_commitments: ['0x' + 'a'.repeat(64)],
+                                    description: '',
+                                },
+                            },
+                            status: {
+                                status: 'pending',
+                                timestamp: '2024-01-01T00:00:00Z',
+                                proposer_id: '0x' + 'c'.repeat(64),
+                                cosigner_sigs: [],
+                            },
+                        },
+                    ],
+                }),
+            });
+            // Deserializes fine, but pins a different block than the one bound into
+            // the summary (mock summary blockCommitment is 'b' * 64).
+            const freed = vi.fn();
+            vi.mocked(chainAnchorFromBase64).mockReturnValueOnce({
+                commitment: () => ({ toHex: () => '0x' + 'e'.repeat(64) }),
+                free: freed,
+                serialize: () => new Uint8Array([9, 9, 9]),
+            });
+            const reExecutionsBefore = vi.mocked(executeForSummaryAt).mock.calls.length;
+            await expect(multisig.syncProposals()).rejects.toThrow('chain anchor does not match the block commitment bound into the tx_summary');
+            expect(vi.mocked(executeForSummaryAt).mock.calls.length).toBe(reExecutionsBefore);
+            expect(freed).toHaveBeenCalledTimes(1);
+        });
         it('should reject non-32-byte signer IDs from GUARDIAN proposals', async () => {
             const config = {
                 threshold: 1,
@@ -816,6 +1008,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
                             description: '',
@@ -858,6 +1051,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 2,
                             signer_commitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
                             description: '',
@@ -932,6 +1126,7 @@ describe('Multisig', () => {
             });
             const proposal = await multisig.createProposal(1, 'AQID', {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 1,
                 targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                 description: '',
@@ -970,6 +1165,7 @@ describe('Multisig', () => {
             });
             await expect(multisig.createProposal(1, 'AQID', {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 1,
                 targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                 description: '',
@@ -1004,13 +1200,14 @@ describe('Multisig', () => {
                     commitment: '0x' + 'c'.repeat(64),
                 }),
             });
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'f'.repeat(64),
                 }),
             });
             await expect(multisig.createProposal(1, 'AQID', {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 1,
                 targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                 description: '',
@@ -1021,10 +1218,13 @@ describe('Multisig', () => {
         it('should include the faucet asset in the proposal description', async () => {
             const { executeForSummary } = await import('./transaction.js');
             vi.mocked(executeForSummary).mockResolvedValue({
-                toCommitment: () => ({
-                    toHex: () => '0x' + 'c'.repeat(64),
-                }),
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const config = {
                 threshold: 1,
@@ -1041,6 +1241,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'p2id',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         recipient_id: '0xrecipient',
                         faucet_id: '0xfaucet',
                         amount: '100',
@@ -1061,17 +1262,20 @@ describe('Multisig', () => {
                     commitment: '0x' + 'c'.repeat(64),
                 }),
             });
-            const proposal = await multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, 1);
+            const proposal = await multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, { nonce: 1 });
             expect(proposal.metadata.description).toBe('Send 100 of asset 0xfaucet... to 0xrecipien...');
         });
         it('threads a private noteType into the request and wire metadata (issue #322)', async () => {
             const { executeForSummary, buildP2idTransactionRequest } = await import('./transaction.js');
             const { NoteType } = await import('@miden-sdk/miden-sdk');
             vi.mocked(executeForSummary).mockResolvedValue({
-                toCommitment: () => ({
-                    toHex: () => '0x' + 'c'.repeat(64),
-                }),
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const config = {
                 threshold: 1,
@@ -1088,6 +1292,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'p2id',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         recipient_id: '0xrecipient',
                         faucet_id: '0xfaucet',
                         amount: '100',
@@ -1109,14 +1314,15 @@ describe('Multisig', () => {
                     commitment: '0x' + 'c'.repeat(64),
                 }),
             });
-            const proposal = await multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, 1, {
+            const proposal = await multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, {
+                nonce: 1,
                 noteType: NoteType.Private,
             });
             // Propose path builds the private note...
-            expect(vi.mocked(buildP2idTransactionRequest)).toHaveBeenCalledWith(expect.any(String), '0xrecipient', '0xfaucet', 100n, expect.anything(), { noteType: NoteType.Private });
+            expect(vi.mocked(buildP2idTransactionRequest)).toHaveBeenCalledWith(expect.any(String), '0xrecipient', '0xfaucet', 100n, { noteType: NoteType.Private });
             // ...and the rebuild-from-metadata path parses note_type back to Private.
             const lastCall = vi.mocked(buildP2idTransactionRequest).mock.calls.at(-1);
-            expect(lastCall[5]).toMatchObject({ noteType: NoteType.Private });
+            expect(lastCall[4]).toMatchObject({ noteType: NoteType.Private });
             // The pushed wire metadata carries note_type so cosigners rebuild the
             // same private note at verification/execution.
             const pushBody = JSON.parse(mockFetch.mock.calls.at(-1)[1].body);
@@ -1124,6 +1330,121 @@ describe('Multisig', () => {
             expect(proposal.metadata.proposalType).toBe('p2id');
             expect(proposal.metadata.noteType).toBe('private');
         });
+        it('threads P2IDE reclaim/timelock heights into the request and wire metadata (issue #366)', async () => {
+            const { executeForSummary, buildP2idTransactionRequest } = await import('./transaction.js');
+            vi.mocked(executeForSummary).mockResolvedValue({
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
+            });
+            const config = {
+                threshold: 1,
+                signerCommitments: ['0x' + 'a'.repeat(64)],
+                guardianCommitment: '0x' + 'c'.repeat(64),
+            };
+            const multisig = createTestMultisig(config);
+            const mockDelta = {
+                account_id: '0x' + 'a'.repeat(30),
+                nonce: 1,
+                prev_commitment: '0x' + 'b'.repeat(64),
+                delta_payload: {
+                    tx_summary: { data: 'AQID' },
+                    signatures: [],
+                    metadata: {
+                        proposal_type: 'p2id',
+                        recipient_id: '0xrecipient',
+                        faucet_id: '0xfaucet',
+                        amount: '100',
+                        reclaim_height: 12345,
+                        timelock_height: 700,
+                        description: '',
+                    },
+                },
+                status: {
+                    status: 'pending',
+                    timestamp: '2024-01-01T00:00:00Z',
+                    proposer_id: '0x' + 'c'.repeat(64),
+                    cosigner_sigs: [],
+                },
+            };
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({
+                    delta: mockDelta,
+                    commitment: '0x' + 'c'.repeat(64),
+                }),
+            });
+            const proposal = await multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, {
+                nonce: 1,
+                reclaimHeight: 12345,
+                timelockHeight: 700,
+            });
+            // Propose path builds the P2IDE note from the heights...
+            const lastCall = vi.mocked(buildP2idTransactionRequest).mock.calls.at(-1);
+            expect(lastCall[4]).toMatchObject({ reclaimHeight: 12345, timelockHeight: 700 });
+            // ...and the pushed wire metadata carries the heights so cosigners
+            // rebuild the same P2IDE note at verification/execution.
+            const pushBody = JSON.parse(mockFetch.mock.calls.at(-1)[1].body);
+            expect(pushBody.delta_payload.metadata.reclaim_height).toBe(12345);
+            expect(pushBody.delta_payload.metadata.timelock_height).toBe(700);
+            expect(proposal.metadata.proposalType).toBe('p2id');
+            expect(proposal.metadata).toMatchObject({ reclaimHeight: 12345, timelockHeight: 700 });
+        });
+        it('omits the heights from wire metadata for a plain P2ID send (pre-#366 shape)', async () => {
+            const { executeForSummary } = await import('./transaction.js');
+            vi.mocked(executeForSummary).mockResolvedValue({
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
+            });
+            const config = {
+                threshold: 1,
+                signerCommitments: ['0x' + 'a'.repeat(64)],
+                guardianCommitment: '0x' + 'c'.repeat(64),
+            };
+            const multisig = createTestMultisig(config);
+            const mockDelta = {
+                account_id: '0x' + 'a'.repeat(30),
+                nonce: 1,
+                prev_commitment: '0x' + 'b'.repeat(64),
+                delta_payload: {
+                    tx_summary: { data: 'AQID' },
+                    signatures: [],
+                    metadata: {
+                        proposal_type: 'p2id',
+                        recipient_id: '0xrecipient',
+                        faucet_id: '0xfaucet',
+                        amount: '100',
+                        description: '',
+                    },
+                },
+                status: {
+                    status: 'pending',
+                    timestamp: '2024-01-01T00:00:00Z',
+                    proposer_id: '0x' + 'c'.repeat(64),
+                    cosigner_sigs: [],
+                },
+            };
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({
+                    delta: mockDelta,
+                    commitment: '0x' + 'c'.repeat(64),
+                }),
+            });
+            await multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, { nonce: 1 });
+            const pushBody = JSON.parse(mockFetch.mock.calls.at(-1)[1].body);
+            expect('reclaim_height' in pushBody.delta_payload.metadata).toBe(false);
+            expect('timelock_height' in pushBody.delta_payload.metadata).toBe(false);
+        });
     });
     describe('exportNoteToBytes / importNoteFromBytes (issue #356)', () => {
         const config = {
@@ -1219,6 +1540,7 @@ describe('Multisig', () => {
             const proposal = {
                 metadata: {
                     proposalType: 'p2id',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     recipientId: '0x' + 'b'.repeat(30),
                     faucetId: '0x' + 'c'.repeat(30),
                     amount: '100',
@@ -1240,10 +1562,13 @@ describe('Multisig', () => {
     describe('createChangeThresholdProposal', () => {
         it('passes the signer scheme to update-signers requests', async () => {
             vi.mocked(executeForSummary).mockResolvedValue({
-                toCommitment: () => ({
-                    toHex: () => '0x' + 'c'.repeat(64),
-                }),
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const ecdsaSigner = {
                 ...mockSigner,
@@ -1265,6 +1590,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'change_threshold',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         target_threshold: 2,
                         description: '',
                     },
@@ -1284,14 +1610,105 @@ describe('Multisig', () => {
                 }),
             });
             const multisig = createTestMultisig(config, ecdsaSigner);
-            await multisig.createChangeThresholdProposal(2, 1);
+            await multisig.createChangeThresholdProposal(2, { nonce: 1 });
             expect(buildUpdateSignersTransactionRequest).toHaveBeenCalledWith(mockWebClient, 2, config.signerCommitments, { signatureScheme: 'ecdsa' });
         });
     });
+    describe('createAddSignerProposal / createRemoveSignerProposal', () => {
+        const config = {
+            threshold: 2,
+            signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64), '0x' + 'd'.repeat(64)],
+            guardianCommitment: '0x' + 'c'.repeat(64),
+        };
+        const mockPushResponse = (proposalType) => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({
+                    delta: {
+                        account_id: '0x' + 'a'.repeat(30),
+                        nonce: 1,
+                        prev_commitment: '0x' + 'b'.repeat(64),
+                        delta_payload: {
+                            tx_summary: { data: 'AQID' },
+                            signatures: [],
+                            metadata: { proposal_type: proposalType, description: '' },
+                        },
+                        status: {
+                            status: 'pending',
+                            timestamp: '2024-01-01T00:00:00Z',
+                            proposer_id: '0x' + 'c'.repeat(64),
+                            cosigner_sigs: [],
+                        },
+                    },
+                    commitment: '0x' + 'c'.repeat(64),
+                }),
+            });
+        };
+        beforeEach(() => {
+            vi.mocked(executeForSummary).mockResolvedValue({
+                summary: {
+                    toCommitment: () => ({ toHex: () => '0x' + 'c'.repeat(64) }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
+            });
+        });
+        it('add: passes newThreshold from the options bag and appends the commitment', async () => {
+            mockPushResponse('add_signer');
+            const newCommitment = '0x' + 'e'.repeat(64);
+            const multisig = createTestMultisig(config);
+            await multisig.createAddSignerProposal(newCommitment, { nonce: 1, newThreshold: 3 });
+            expect(buildUpdateSignersTransactionRequest).toHaveBeenCalledWith(mockWebClient, 3, [...config.signerCommitments, newCommitment], { signatureScheme: mockSigner.scheme });
+        });
+        it('add: defaults to the current threshold when newThreshold is omitted', async () => {
+            mockPushResponse('add_signer');
+            const multisig = createTestMultisig(config);
+            await multisig.createAddSignerProposal('0x' + 'e'.repeat(64), { nonce: 1 });
+            expect(buildUpdateSignersTransactionRequest).toHaveBeenCalledWith(mockWebClient, config.threshold, expect.any(Array), { signatureScheme: mockSigner.scheme });
+        });
+        it('remove: passes newThreshold from the options bag and drops the commitment', async () => {
+            mockPushResponse('remove_signer');
+            const multisig = createTestMultisig(config);
+            await multisig.createRemoveSignerProposal('0x' + 'd'.repeat(64), { nonce: 1, newThreshold: 1 });
+            expect(buildUpdateSignersTransactionRequest).toHaveBeenCalledWith(mockWebClient, 1, [config.signerCommitments[0], config.signerCommitments[1]], { signatureScheme: mockSigner.scheme });
+        });
+        it('remove: defaults to min(current threshold, remaining signers) when newThreshold is omitted', async () => {
+            mockPushResponse('remove_signer');
+            const multisig = createTestMultisig(config);
+            await multisig.createRemoveSignerProposal('0x' + 'd'.repeat(64), { nonce: 1 });
+            expect(buildUpdateSignersTransactionRequest).toHaveBeenCalledWith(mockWebClient, 2, expect.any(Array), { signatureScheme: mockSigner.scheme });
+        });
+    });
+    describe('legacy positional-caller guard (issue #387)', () => {
+        const config = {
+            threshold: 1,
+            signerCommitments: ['0x' + 'a'.repeat(64)],
+            guardianCommitment: '0x' + 'c'.repeat(64),
+        };
+        it('rejects a legacy positional nonce where the options bag is expected', async () => {
+            const multisig = createTestMultisig(config);
+            await expect(multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, 1)).rejects.toThrow(/issue #387/);
+            await expect(multisig.createConsumeNotesProposal(['0x1'], 1)).rejects.toThrow(/issue #387/);
+            await expect(multisig.createAddSignerProposal('0x' + 'e'.repeat(64), 1)).rejects.toThrow(/issue #387/);
+            await expect(multisig.createCustomProposal(new Uint8Array([1]), 'label', 1)).rejects.toThrow(/issue #387/);
+        });
+        it('rejects a legacy trailing argument after the options slot', async () => {
+            const multisig = createTestMultisig(config);
+            // Pre-#387 pattern: createP2idProposal(r, f, amount, nonceHole, { noteType })
+            await expect(multisig.createP2idProposal('0xrecipient', '0xfaucet', 100n, undefined, {
+                noteType: 'private',
+            })).rejects.toThrow(/issue #387/);
+            // Pre-#387 pattern: createAddSignerProposal(commitment, nonceHole, newThreshold)
+            await expect(multisig.createAddSignerProposal('0x' + 'e'.repeat(64), undefined, 3)).rejects.toThrow(/issue #387/);
+        });
+    });
     describe('createSwitchGuardianProposal', () => {
         it('should verify new endpoint commitment before creating proposal', async () => {
             vi.mocked(executeForSummary).mockResolvedValue({
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const config = {
                 threshold: 1,
@@ -1331,7 +1748,10 @@ describe('Multisig', () => {
         });
         it('should reject switch proposal when endpoint commitment does not match', async () => {
             vi.mocked(executeForSummary).mockResolvedValue({
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const config = {
                 threshold: 1,
@@ -1347,7 +1767,10 @@ describe('Multisig', () => {
         });
         it('should use the signer scheme when resolving new GUARDIAN commitments', async () => {
             vi.mocked(executeForSummary).mockResolvedValue({
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const ecdsaSigner = {
                 ...mockSigner,
@@ -1392,10 +1815,13 @@ describe('Multisig', () => {
     describe('createUpdateProcedureThresholdProposal', () => {
         it('should create procedure-threshold update proposals', async () => {
             vi.mocked(executeForSummary).mockResolvedValue({
-                toCommitment: () => ({
-                    toHex: () => '0x' + 'c'.repeat(64),
-                }),
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const config = {
                 threshold: 2,
@@ -1412,6 +1838,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'update_procedure_threshold',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         target_threshold: 1,
                         target_procedure: 'send_asset',
                         description: '',
@@ -1431,7 +1858,7 @@ describe('Multisig', () => {
                     commitment: '0x' + 'c'.repeat(64),
                 }),
             });
-            const proposal = await multisig.createUpdateProcedureThresholdProposal('send_asset', 1, 1);
+            const proposal = await multisig.createUpdateProcedureThresholdProposal('send_asset', 1, { nonce: 1 });
             expect(buildUpdateProcedureThresholdTransactionRequest).toHaveBeenCalledWith(mockWebClient, 'send_asset', 1, { signatureScheme: 'falcon' });
             expect(proposal.metadata.proposalType).toBe('update_procedure_threshold');
             if (proposal.metadata.proposalType === 'update_procedure_threshold') {
@@ -1441,10 +1868,13 @@ describe('Multisig', () => {
         });
         it('passes the signer scheme to ECDSA procedure-threshold updates', async () => {
             vi.mocked(executeForSummary).mockResolvedValue({
-                toCommitment: () => ({
-                    toHex: () => '0x' + 'c'.repeat(64),
-                }),
-                serialize: () => new Uint8Array([1, 2, 3]),
+                summary: {
+                    toCommitment: () => ({
+                        toHex: () => '0x' + 'c'.repeat(64),
+                    }),
+                    serialize: () => new Uint8Array([1, 2, 3]),
+                },
+                anchor: createMockChainAnchor(),
             });
             const ecdsaSigner = {
                 ...mockSigner,
@@ -1467,6 +1897,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'update_procedure_threshold',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         target_threshold: 1,
                         target_procedure: 'send_asset',
                         description: '',
@@ -1486,7 +1917,7 @@ describe('Multisig', () => {
                     commitment: '0x' + 'c'.repeat(64),
                 }),
             });
-            await multisig.createUpdateProcedureThresholdProposal('send_asset', 1, 1);
+            await multisig.createUpdateProcedureThresholdProposal('send_asset', 1, { nonce: 1 });
             expect(buildUpdateProcedureThresholdTransactionRequest).toHaveBeenCalledWith(mockWebClient, 'send_asset', 1, { signatureScheme: 'ecdsa' });
         });
     });
@@ -1523,6 +1954,7 @@ describe('Multisig', () => {
             });
             await multisig.createProposal(1, 'AQID', {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 1,
                 targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                 description: '',
@@ -1545,6 +1977,7 @@ describe('Multisig', () => {
                     ...mockDelta.delta_payload,
                     metadata: {
                         proposal_type: 'add_signer',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         description: '',
                         target_threshold: 1,
                         signer_commitments: ['0x' + 'a'.repeat(64)],
@@ -1591,11 +2024,12 @@ describe('Multisig', () => {
             });
             await multisig.createProposal(1, 'AQID', {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 1,
                 targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                 description: '',
             });
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'f'.repeat(64),
                 }),
@@ -1623,6 +2057,7 @@ describe('Multisig', () => {
                                 signatures: [],
                                 metadata: {
                                     proposal_type: 'add_signer',
+                                    chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                                     description: '',
                                     target_threshold: 1,
                                     signer_commitments: [mockSigner.commitment],
@@ -1650,7 +2085,7 @@ describe('Multisig', () => {
                 guardianCommitment: '0x' + 'c'.repeat(64),
             };
             const multisig = createTestMultisig(config);
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'f'.repeat(64),
                 }),
@@ -1663,6 +2098,7 @@ describe('Multisig', () => {
                 signatures: [],
                 metadata: {
                     proposalType: 'add_signer',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -1678,7 +2114,7 @@ describe('Multisig', () => {
                 guardianCommitment: '0x' + 'c'.repeat(64),
             };
             const multisig = createTestMultisig(config);
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'c'.repeat(64),
                 }),
@@ -1691,6 +2127,7 @@ describe('Multisig', () => {
                 signatures: [],
                 metadata: {
                     proposalType: 'add_signer',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -1698,11 +2135,12 @@ describe('Multisig', () => {
             }));
             proposal.metadata = {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 2,
                 targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                 description: '',
             };
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'f'.repeat(64),
                 }),
@@ -1728,6 +2166,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             description: '',
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
@@ -1777,6 +2216,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'change_threshold',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             description: '',
                             target_threshold: 2,
                             signer_commitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
@@ -1826,7 +2266,7 @@ describe('Multisig', () => {
                 // Feature 009: only a conforming { code, message, meta } envelope is
                 // folded into the error message; raw text bodies are dropped.
                 text: async () => JSON.stringify({
-                    code: 'GUARDIAN_PROPOSAL_NOT_FOUND',
+                    code: 'proposal_not_found',
                     message: 'Proposal not found',
                     meta: { retryable: false },
                 }),
@@ -1855,6 +2295,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'add_signer',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -1886,6 +2327,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'change_threshold',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -1924,6 +2366,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'change_threshold',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -1945,6 +2388,7 @@ describe('Multisig', () => {
                 signatures: [],
                 metadata: {
                     proposalType: 'add_signer',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 2,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
                     description: '',
@@ -2010,6 +2454,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'change_threshold',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -2026,6 +2471,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'change_threshold',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
                         },
@@ -2051,8 +2497,14 @@ describe('Multisig', () => {
             await expect(multisig.createTransactionProposalRequest(requestedProposalId)).resolves.toBe(finalRequest);
             expect(vi.mocked(signatureHexToBytes)).toHaveBeenNthCalledWith(1, cosignerSignature, 'ecdsa');
             expect(vi.mocked(signatureHexToBytes)).toHaveBeenNthCalledWith(2, ackSignature, 'ecdsa');
-            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything(), cosignerPubkey, cosignerSignature);
-            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything(), ackPubkey, ackSignature);
+            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything());
+            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything());
+            // The advice payload now comes from the SDK, so the routing assertion is
+            // the commitment each entry is keyed on: cosigner first, GUARDIAN ack
+            // second. Swapping the two entries must not pass.
+            const adviceCalls = vi.mocked(buildSignatureAdviceEntry).mock.calls;
+            expect(adviceCalls[0][0].toHex()).toBe(config.signerCommitments[0]);
+            expect(adviceCalls[1][0].toHex()).toBe(config.guardianCommitment);
             expect(mockWebClient.executeTransaction).not.toHaveBeenCalled();
             expect(mockWebClient.proveTransaction).not.toHaveBeenCalled();
             expect(mockWebClient.submitProvenTransaction).not.toHaveBeenCalled();
@@ -2090,6 +2542,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey,
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2132,6 +2585,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             description: '',
                             target_threshold: 2,
                             signer_commitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
@@ -2166,7 +2620,7 @@ describe('Multisig', () => {
             };
             const multisig = createTestMultisig(config);
             const proposalId = '0x' + 'c'.repeat(64);
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + 'd'.repeat(64),
                 }),
@@ -2186,6 +2640,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'change_threshold',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -2217,6 +2672,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey: '0x' + '1'.repeat(64),
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2257,6 +2713,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey: '0x' + '1'.repeat(64),
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2324,6 +2781,7 @@ describe('Multisig', () => {
                     ],
                     metadata: {
                         proposalType: 'change_threshold',
+                        chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                         targetThreshold: 1,
                         targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                         description: '',
@@ -2340,6 +2798,7 @@ describe('Multisig', () => {
                             signatures: [],
                             metadata: {
                                 proposal_type: 'change_threshold',
+                                chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                                 target_threshold: 1,
                                 signer_commitments: ['0x' + 'a'.repeat(64)],
                             },
@@ -2410,6 +2869,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey: '0x' + '1'.repeat(64),
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2446,6 +2906,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             description: '',
                             target_threshold: 2,
                             signer_commitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
@@ -2473,7 +2934,7 @@ describe('Multisig', () => {
             // Proposal ID is mocked to return 'c'.repeat(64)
             await expect(multisig.executeProposal('0x' + 'c'.repeat(64))).rejects.toThrow('not ready for execution');
         });
-        it('should fail when GUARDIAN ack signature is missing (selector ON)', async () => {
+        it('should fail when GUARDIAN ack signature is missing', async () => {
             const config = {
                 threshold: 1,
                 signerCommitments: ['0x' + 'a'.repeat(64)],
@@ -2489,6 +2950,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'add_signer',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         description: '',
                         target_threshold: 1,
                         signer_commitments: ['0x' + 'a'.repeat(64)],
@@ -2570,6 +3032,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'change_threshold',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -2586,6 +3049,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'change_threshold',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
                         },
@@ -2626,8 +3090,14 @@ describe('Multisig', () => {
             expect(mockWebClient.applyTransaction).toHaveBeenCalledTimes(1);
             expect(vi.mocked(signatureHexToBytes)).toHaveBeenNthCalledWith(1, cosignerSignature, 'ecdsa');
             expect(vi.mocked(signatureHexToBytes)).toHaveBeenNthCalledWith(2, ackSignature, 'ecdsa');
-            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything(), cosignerPubkey, cosignerSignature);
-            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything(), ackPubkey, ackSignature);
+            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything());
+            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything());
+            // The advice payload now comes from the SDK, so the routing assertion is
+            // the commitment each entry is keyed on: cosigner first, GUARDIAN ack
+            // second. Swapping the two entries must not pass.
+            const adviceCalls = vi.mocked(buildSignatureAdviceEntry).mock.calls;
+            expect(adviceCalls[0][0].toHex()).toBe(config.signerCommitments[0]);
+            expect(adviceCalls[1][0].toHex()).toBe(config.guardianCommitment);
         });
         it('should execute imported ECDSA proposals with scheme-aware advice', async () => {
             const { buildSignatureAdviceEntry, signatureHexToBytes } = await import('./utils/signature.js');
@@ -2666,6 +3136,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'change_threshold',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     targetThreshold: 1,
                     targetSignerCommitments: ['0x' + 'a'.repeat(64)],
                     description: '',
@@ -2682,6 +3153,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'change_threshold',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 1,
                             signer_commitments: ['0x' + 'a'.repeat(64)],
                         },
@@ -2711,8 +3183,14 @@ describe('Multisig', () => {
             expect(mockWebClient.applyTransaction).toHaveBeenCalledTimes(1);
             expect(vi.mocked(signatureHexToBytes)).toHaveBeenNthCalledWith(1, cosignerSignature, 'ecdsa');
             expect(vi.mocked(signatureHexToBytes)).toHaveBeenNthCalledWith(2, ackSignature, 'ecdsa');
-            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything(), cosignerPubkey, cosignerSignature);
-            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything(), ackPubkey, ackSignature);
+            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything());
+            expect(vi.mocked(buildSignatureAdviceEntry)).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything());
+            // The advice payload now comes from the SDK, so the routing assertion is
+            // the commitment each entry is keyed on: cosigner first, GUARDIAN ack
+            // second. Swapping the two entries must not pass.
+            const adviceCalls = vi.mocked(buildSignatureAdviceEntry).mock.calls;
+            expect(adviceCalls[0][0].toHex()).toBe(config.signerCommitments[0]);
+            expect(adviceCalls[1][0].toHex()).toBe(config.guardianCommitment);
         });
         it('should verify switch_guardian endpoint commitment before execution', async () => {
             const config = {
@@ -2738,6 +3216,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey,
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2759,6 +3238,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'switch_guardian',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             new_guardian_pubkey: newGuardianPubkey,
                             new_guardian_endpoint: 'http://new-guardian.com',
                         },
@@ -2818,6 +3298,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey,
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2865,6 +3346,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey: '0x' + '1'.repeat(64),
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2905,6 +3387,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey: '0x' + '1'.repeat(64),
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2950,6 +3433,7 @@ describe('Multisig', () => {
                 ],
                 metadata: {
                     proposalType: 'switch_guardian',
+                    chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                     newGuardianPubkey: '0x' + '1'.repeat(64),
                     newGuardianEndpoint: 'http://new-guardian.com',
                     description: '',
@@ -2975,9 +3459,32 @@ describe('Multisig', () => {
                 .mockRejectedValueOnce(transient)
                 .mockRejectedValueOnce(transient)
                 .mockResolvedValueOnce({});
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({
+                    account_id: '0x' + 'a'.repeat(30),
+                    nonce: 1,
+                    prev_commitment: '0x' + 'b'.repeat(64),
+                    delta_payload: {
+                        tx_summary: { data: 'AQID' },
+                        signatures: [],
+                        metadata: {
+                            proposal_type: 'b2agg',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
+                            description: '',
+                        },
+                    },
+                    status: {
+                        status: 'pending',
+                        timestamp: '2024-01-01T00:00:00Z',
+                        proposer_id: '0x' + 'c'.repeat(64),
+                        cosigner_sigs: [],
+                    },
+                }),
+            });
             vi.useFakeTimers();
             try {
-                const submission = multisig.submitTransaction({});
+                const submission = multisig.submitTransaction('0x' + 'c'.repeat(64), {});
                 await vi.runAllTimersAsync();
                 await submission;
             }
@@ -3002,6 +3509,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: proposalType,
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         description: '',
                     },
                 },
@@ -3032,6 +3540,7 @@ describe('Multisig', () => {
             };
             builtinDelta.delta_payload.metadata = {
                 proposal_type: 'change_threshold',
+                chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                 description: '',
                 target_threshold: 1,
                 signer_commitments: ['0x' + 'a'.repeat(64)],
@@ -3064,7 +3573,7 @@ describe('Multisig', () => {
             const multisig = createTestMultisig(config);
             // Signed commitment comes from TransactionSummary.deserialize -> 'c' * 64.
             // Make the binding request derive a different commitment so the check fails.
-            vi.mocked(executeForSummary).mockResolvedValueOnce({
+            vi.mocked(executeForSummaryAt).mockResolvedValueOnce({
                 toCommitment: () => ({
                     toHex: () => '0x' + '9'.repeat(64),
                 }),
@@ -3115,6 +3624,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'add_signer',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         target_threshold: 2,
                         signer_commitments: ['0x1', '0x2'],
                     },
@@ -3135,6 +3645,7 @@ describe('Multisig', () => {
             });
             const proposal = await multisig.createProposal(1, 'AQID', {
                 proposalType: 'add_signer',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 targetThreshold: 2,
                 targetSignerCommitments: ['0x1', '0x2'],
                 description: '',
@@ -3169,6 +3680,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'p2id',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             recipient_id: '0xrecipient',
                             faucet_id: '0xfaucet',
                             amount: '100',
@@ -3208,6 +3720,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'add_signer',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         target_threshold: 2,
                         signer_commitments: ['0x1', '0x2'],
                         description: '',
@@ -3229,6 +3742,7 @@ describe('Multisig', () => {
             });
             const proposal = await multisig.createProposal(1, 'AQID', {
                 proposalType: 'consume_notes',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 noteIds: ['0xnote1', '0xnote2'],
                 description: '',
             });
@@ -3250,6 +3764,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposal_type: 'add_signer',
+                        chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                         target_threshold: 1,
                         signer_commitments: ['0x' + 'a'.repeat(64)],
                         description: '',
@@ -3271,6 +3786,7 @@ describe('Multisig', () => {
             });
             const proposal = await multisig.createProposal(1, 'AQID', {
                 proposalType: 'p2id',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 recipientId: '0xrecipient',
                 faucetId: '0xfaucet',
                 amount: '100',
@@ -3294,6 +3810,7 @@ describe('Multisig', () => {
                     signatures: [],
                     metadata: {
                         proposalType: 'add_signer',
+                        chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                         targetThreshold: 2,
                         targetSignerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
                         description: '',
@@ -3315,6 +3832,7 @@ describe('Multisig', () => {
             });
             const proposal = await multisig.createProposal(1, 'AQID', {
                 proposalType: 'switch_guardian',
+                chainAnchor: MOCK_CHAIN_ANCHOR_B64,
                 newGuardianPubkey: '0xnewpubkey',
                 newGuardianEndpoint: 'http://new-guardian.com',
                 description: '',
@@ -3341,6 +3859,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 2,
                             signer_commitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
                             description: '',
@@ -3374,6 +3893,7 @@ describe('Multisig', () => {
                         ...mockProposalsPending[0].delta_payload,
                         metadata: {
                             proposal_type: 'add_signer',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 2,
                             signer_commitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
                             description: '',
@@ -3465,6 +3985,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'change_threshold',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             target_threshold: 3,
                             signer_commitments: ['0xa', '0xb', '0xc'],
                             salt: '0xlegacysalt',
@@ -3509,6 +4030,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'p2id',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             recipient_id: '0xrecipient',
                             faucet_id: '0xfaucet',
                             amount: '12345',
@@ -3559,6 +4081,7 @@ describe('Multisig', () => {
                         signatures: [],
                         metadata: {
                             proposal_type: 'switch_guardian',
+                            chain_anchor: MOCK_CHAIN_ANCHOR_B64,
                             new_guardian_pubkey: '0xnewpubkey',
                             new_guardian_endpoint: 'http://new-guardian.com',
                             salt: '0xsalt',