@sanning/proof 0.17.0 → 0.18.0

package/dist/crypto.d.ts

@@ -4,6 +4,23 @@ export declare function isHexField(value: unknown, nibbles: number, lower?: bool
 export declare function utf8(s: string): Uint8Array;
 export declare function sha256Bytes(bytes: Uint8Array): Promise<Uint8Array>;
 export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
+/** The sentence a refused signature reads in an envelope result. */
+export declare const SIGNATURE_FAILED = "Ed25519 signature verification failed";
+export declare const ED25519_RULE_REASONS: readonly ["the public key is not the canonical encoding of a point", "the public key is a point of small order", "the public key is not in the prime-order subgroup", "R is not the canonical encoding of a point", "R is the identity", "R is a point of small order", "R is not in the prime-order subgroup", "S is not below the group order"];
+/**
+ * The clause of the rule that (`publicKey`, `signature`) breaks, or `null`
+ * when it breaks none and the equation is what is left to check. Lengths are
+ * the caller's (32 and 64 bytes). Never throws.
+ */
+export declare function ed25519RuleReason(signature: Uint8Array, publicKey: Uint8Array): string | null;
+/**
+ * `null` iff `signatureHex` is a signature of `message` under `publicKeyHex`
+ * by the rule; otherwise the sentence the refusal reads: `SIGNATURE_FAILED`,
+ * with `": "` and the clause of the rule it broke when it broke one. A
+ * malformed field, a wrong length and an equation that does not hold read
+ * the bare sentence. Never throws. The Python twin is `ed25519_refusal`.
+ */
+export declare function ed25519Refusal(message: Uint8Array, signatureHex: string, publicKeyHex: string): Promise<string | null>;
 export declare function ed25519Verify(message: Uint8Array, signatureHex: string, publicKeyHex: string): Promise<boolean>;
 export declare function ed25519Sign(message: Uint8Array, privateKeyHex: string): Promise<string>;
 export declare function ed25519PublicKey(privateKeyHex: string): Promise<string>;

package/dist/crypto.js

@@ -6,7 +6,9 @@ import * as ed from "@noble/ed25519";
 // @noble/ed25519 needs SHA-512 to verify. Wire it to WebCrypto rather than
 // pulling in @noble/hashes. globalThis.crypto.subtle exists in every modern
 // browser and in Node >= 19, so the same code path runs in the app and in tests.
-ed.etc.sha512Async = async (...msgs) => new Uint8Array(await crypto.subtle.digest("SHA-512", asBufferSource(ed.etc.concatBytes(...msgs))));
+// noble 3 ships this provider as its default; it is set here so the kernel
+// says what it hashes with rather than inheriting it.
+ed.hashes.sha512Async = async (message) => new Uint8Array(await crypto.subtle.digest("SHA-512", asBufferSource(message)));
 // WebCrypto's digest() wants a BufferSource backed by a (non-shared) ArrayBuffer.
 // Our byte arrays always are; this keeps TS 5.7's stricter Uint8Array<ArrayBufferLike>
 // typing satisfied without a runtime copy.
@@ -70,31 +72,129 @@ export async function sha256Bytes(bytes) {
 export async function sha256Hex(bytes) {
     return bytesToHex(await sha256Bytes(bytes));
 }
-// Verify an Ed25519 signature. Inputs are hex (signature, public key) as they
-// appear in the envelope; message is raw bytes. Never throws — a malformed
-// signature or key is "not verified," not an exception, so a hostile envelope
-// can't crash the checker.
+// ---------------------------------------------------------------------------
+// The Ed25519 rule (envelope-spec §7, A44, proof#230)
+//
+// Strict RFC 8032 (`zip215: false`, a frozen invariant), and more: the public
+// key A and the signature's R must each be the canonical encoding of a point
+// in the prime-order subgroup other than the identity, and S below the group
+// order L. Only then is the equation checked.
+//
+// Why more than `zip215: false`: noble checks the equation with the cofactor,
+// 8·S·B = 8·R + 8·k·A, and Go's crypto/ed25519 and libsodium without it, so on
+// their own they disagree when A or R has a small-order component. noble 2.3
+// also could not encode an identity R and hashed nothing for k, so it accepted
+// one signature from a key holder over every message. With A and R in the
+// prime-order subgroup the two equations are the same equation, and every
+// kernel accepts exactly the same signatures.
+//
+// Each clause is checked here, in this order, and named in these words: the
+// Python twin is `ed25519_rule_reason` in `src/sanning_proof/ed25519_rule.py`
+// and the Go kernel's `verifyEd25519Strict` in sanning-io/agent `pkg/proof`.
+// Several clauses are ones noble 3 refuses on its own; they are checked here
+// anyway so the refusal names the clause, which a library's `false` cannot.
+/** The sentence a refused signature reads in an envelope result. */
+export const SIGNATURE_FAILED = "Ed25519 signature verification failed";
+export const ED25519_RULE_REASONS = [
+    "the public key is not the canonical encoding of a point",
+    "the public key is a point of small order",
+    "the public key is not in the prime-order subgroup",
+    "R is not the canonical encoding of a point",
+    "R is the identity",
+    "R is a point of small order",
+    "R is not in the prime-order subgroup",
+    "S is not below the group order",
+];
+const [KEY_NOT_CANONICAL, KEY_SMALL_ORDER, KEY_NOT_IN_SUBGROUP, R_NOT_CANONICAL, R_IDENTITY, R_SMALL_ORDER, R_NOT_IN_SUBGROUP, S_NOT_BELOW_L,] = ED25519_RULE_REASONS;
+const ED25519_L = 2n ** 252n + 27742317777372353535851937790883648493n;
+function bytesToNumberLE(bytes) {
+    let v = 0n;
+    for (let i = bytes.length - 1; i >= 0; i--)
+        v = (v << 8n) | BigInt(bytes[i]);
+    return v;
+}
+// `Point.fromBytes(..., false)` is RFC 8032 decoding with its two strict
+// branches: it throws on y at or above p and on x zero with the sign bit set,
+// the two non-canonical encodings of a point, and on bytes that are no point.
+function decodeStrict(bytes) {
+    try {
+        return ed.Point.fromBytes(bytes, false);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The clause of the rule that (`publicKey`, `signature`) breaks, or `null`
+ * when it breaks none and the equation is what is left to check. Lengths are
+ * the caller's (32 and 64 bytes). Never throws.
+ */
+export function ed25519RuleReason(signature, publicKey) {
+    const A = decodeStrict(publicKey);
+    if (A === null)
+        return KEY_NOT_CANONICAL;
+    if (A.isSmallOrder())
+        return KEY_SMALL_ORDER;
+    if (!A.isTorsionFree())
+        return KEY_NOT_IN_SUBGROUP;
+    const R = decodeStrict(signature.subarray(0, 32));
+    if (R === null)
+        return R_NOT_CANONICAL;
+    if (R.is0())
+        return R_IDENTITY;
+    if (R.isSmallOrder())
+        return R_SMALL_ORDER;
+    if (!R.isTorsionFree())
+        return R_NOT_IN_SUBGROUP;
+    if (bytesToNumberLE(signature.subarray(32, 64)) >= ED25519_L)
+        return S_NOT_BELOW_L;
+    return null;
+}
+/**
+ * `null` iff `signatureHex` is a signature of `message` under `publicKeyHex`
+ * by the rule; otherwise the sentence the refusal reads: `SIGNATURE_FAILED`,
+ * with `": "` and the clause of the rule it broke when it broke one. A
+ * malformed field, a wrong length and an equation that does not hold read
+ * the bare sentence. Never throws. The Python twin is `ed25519_refusal`.
+ */
+export async function ed25519Refusal(message, signatureHex, publicKeyHex) {
+    let signature;
+    let publicKey;
+    try {
+        signature = hexToBytes(signatureHex);
+        publicKey = hexToBytes(publicKeyHex);
+    }
+    catch {
+        return SIGNATURE_FAILED;
+    }
+    if (signature.length !== 64 || publicKey.length !== 32)
+        return SIGNATURE_FAILED;
+    const reason = ed25519RuleReason(signature, publicKey);
+    if (reason !== null)
+        return `${SIGNATURE_FAILED}: ${reason}`;
+    try {
+        return (await ed.verifyAsync(signature, message, publicKey, { zip215: false })) ? null : SIGNATURE_FAILED;
+    }
+    catch {
+        return SIGNATURE_FAILED;
+    }
+}
+// Verify an Ed25519 signature by the rule above. Inputs are hex (signature,
+// public key) as they appear in the envelope; message is raw bytes. Never
+// throws — a malformed signature or key is "not verified," not an exception,
+// so a hostile envelope can't crash the checker.
 // Arguments in the Python twin's order, `ed25519_verify(message,
 // signature_hex, public_key_hex)` (P-03, 0.13.0). The message came second
 // until 0.13.0; a caller that still passes the signature first gets a compile
 // error, because a string is not a Uint8Array.
 export async function ed25519Verify(message, signatureHex, publicKeyHex) {
-    try {
-        // zip215:false → strict RFC-8032 verification, matching the Go agent's
-        // crypto/ed25519 exactly (noble defaults to the more lenient zip215:true).
-        return await ed.verifyAsync(hexToBytes(signatureHex), message, hexToBytes(publicKeyHex), {
-            zip215: false,
-        });
-    }
-    catch {
-        return false;
-    }
+    return (await ed25519Refusal(message, signatureHex, publicKeyHex)) === null;
 }
 // Ed25519 SIGN the raw `message` bytes with a 32-byte private-key seed (lowercase
 // hex). Returns the signature as lowercase hex. The signing counterpart to
 // ed25519Verify — the ONE signing primitive the composer (`proof export`,
 // evidence-export.md §5) needs to Ed25519-sign the export wrapper with the
-// exporter's key ("anyone can export", P-4). The @noble sha512Async hook wired at
+// exporter's key ("anyone can export", P-4). The @noble sha512Async provider wired at
 // module load serves signing and verification alike, so this stays WebCrypto-only.
 export async function ed25519Sign(message, privateKeyHex) {
     return bytesToHex(await ed.signAsync(message, hexToBytes(privateKeyHex)));

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { ACCEPTED_SPEC_MAJORS, contentHashes, jcs, specVersionSupported, verifyEnvelope, } from "./verifier.js";
-export { bytesToHex, deriveOperatorAddress, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
+export { bytesToHex, deriveOperatorAddress, ed25519Refusal, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
 export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyInclusion, } from "./merkle.js";
 export type { ContentRole, Envelope, Subject, VerificationResult, VerifyOptions } from "./types.js";
 export { ACCEPTED_EVIDENCE_MAJORS, ANCHOR_TRACE_BODY_TYPE, CO_SIGNATURES_NOTE, EXPORT_BODY_TYPE, STAMP_BODY_VERSION, STAMP_TRACE_BODY_TYPE, STAMP_EVIDENCE_BODY_TYPE, coSignaturesPresent, disclosedContent, recomputeExportVerdict, verifyEvidenceBundle, } from "./evidence.js";

package/dist/index.js

@@ -18,7 +18,7 @@
 // mutable accept-set would be a runtime-widenable kernel. Additive — no
 // existing export changes.
 export { ACCEPTED_SPEC_MAJORS, contentHashes, jcs, specVersionSupported, verifyEnvelope, } from "./verifier.js";
-export { bytesToHex, deriveOperatorAddress, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
+export { bytesToHex, deriveOperatorAddress, ed25519Refusal, ed25519Verify, hexToBytes, sha256Bytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
 export { EMPTY_TREE_ROOT_HEX, auditPath, leafHash, merkleRoot, nodeHash, verifyInclusion, } from "./merkle.js";
 // Evidence-bundle verification (specs/evidence-bundle.md): the signed
 // sanning.evidence/v1 wrapper carrying the sanning.anchor.trace/v3 body. The CLI

package/dist/verifier.js

@@ -7,7 +7,7 @@
 // Conformance is enforced by test/conformance.test.ts, which runs every
 // corpus test vector through this code and asserts byte-for-byte agreement.
 import canonicalize from "canonicalize";
-import { ed25519Verify, isHexField, sha256Hex, utf8 } from "./crypto.js";
+import { SIGNATURE_FAILED, ed25519Refusal, isHexField, sha256Hex, utf8 } from "./crypto.js";
 // Fail-closed accepted-profile registry (envelope-spec §2): exactly the
 // accepted profile majors, nothing else. Minors within an accepted
 // major ("sanning.agent/v1.<minor>") are additive and tolerated — matching the Go
@@ -808,18 +808,22 @@ async function verifyEnvelopeChecked(env, opts) {
     // invalidating the primary signature; the field is reserved/default-absent.
     // The corpus has no co-signed vectors, so this strip is pinned by an explicit
     // unit test rather than by conformance.
+    // The refusal names the clause of the Ed25519 rule a signature breaks
+    // (envelope-spec §7, A44), so a forged shape reads differently from a
+    // corrupted byte; an equation that does not hold reads the bare sentence.
     let signatureOk = false;
     try {
         const { signature: _signature, co_signatures: _coSignatures, ...envelopeForSig } = env;
-        signatureOk = await ed25519Verify(utf8(jcs(envelopeForSig)), env.signature, env.public_key);
-        if (!signatureOk)
-            errors.push("Ed25519 signature verification failed");
+        const refusal = await ed25519Refusal(utf8(jcs(envelopeForSig)), env.signature, env.public_key);
+        signatureOk = refusal === null;
+        if (refusal !== null)
+            errors.push(refusal);
     }
     catch {
         // The sentence the Python kernel writes for the same failure. What was
         // thrown is the host's wording (`jcs: input nesting exceeds ...`), and a
         // public result carries the kernel's own words only (proof#150).
-        errors.push("Ed25519 signature verification failed");
+        errors.push(SIGNATURE_FAILED);
     }
     // Check 3 (optional) — Content Bind: the user's bytes match a hash this
     // envelope commits to. The tag got us here; only this proves the bytes match.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanning/proof",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "TypeScript kernel of the Sanning verification stack: RFC 8785 (JCS) canonicalization, SHA-256, and Ed25519 verification for Verifiable Event Envelopes. Full-family verifier (inline + external commitment); accepts sanning.agent/v1 and sanning.events/v2. Conformance-gated byte-for-byte against the test-vectors corpus.",
   "license": "MIT",
   "type": "module",
@@ -30,7 +30,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@noble/ed25519": "^2.1.0",
+    "@noble/ed25519": "^3.2.0",
     "canonicalize": "^2.0.0"
   },
   "devDependencies": {

package/src/crypto.ts

@@ -8,8 +8,10 @@ import * as ed from "@noble/ed25519";
 // @noble/ed25519 needs SHA-512 to verify. Wire it to WebCrypto rather than
 // pulling in @noble/hashes. globalThis.crypto.subtle exists in every modern
 // browser and in Node >= 19, so the same code path runs in the app and in tests.
-ed.etc.sha512Async = async (...msgs: Uint8Array[]): Promise<Uint8Array> =>
-  new Uint8Array(await crypto.subtle.digest("SHA-512", asBufferSource(ed.etc.concatBytes(...msgs))));
+// noble 3 ships this provider as its default; it is set here so the kernel
+// says what it hashes with rather than inheriting it.
+ed.hashes.sha512Async = async (message) =>
+  new Uint8Array(await crypto.subtle.digest("SHA-512", asBufferSource(message)));
 
 // WebCrypto's digest() wants a BufferSource backed by a (non-shared) ArrayBuffer.
 // Our byte arrays always are; this keeps TS 5.7's stricter Uint8Array<ArrayBufferLike>
@@ -76,10 +78,125 @@ export async function sha256Hex(bytes: Uint8Array): Promise<string> {
   return bytesToHex(await sha256Bytes(bytes));
 }
 
-// Verify an Ed25519 signature. Inputs are hex (signature, public key) as they
-// appear in the envelope; message is raw bytes. Never throws — a malformed
-// signature or key is "not verified," not an exception, so a hostile envelope
-// can't crash the checker.
+// ---------------------------------------------------------------------------
+// The Ed25519 rule (envelope-spec §7, A44, proof#230)
+//
+// Strict RFC 8032 (`zip215: false`, a frozen invariant), and more: the public
+// key A and the signature's R must each be the canonical encoding of a point
+// in the prime-order subgroup other than the identity, and S below the group
+// order L. Only then is the equation checked.
+//
+// Why more than `zip215: false`: noble checks the equation with the cofactor,
+// 8·S·B = 8·R + 8·k·A, and Go's crypto/ed25519 and libsodium without it, so on
+// their own they disagree when A or R has a small-order component. noble 2.3
+// also could not encode an identity R and hashed nothing for k, so it accepted
+// one signature from a key holder over every message. With A and R in the
+// prime-order subgroup the two equations are the same equation, and every
+// kernel accepts exactly the same signatures.
+//
+// Each clause is checked here, in this order, and named in these words: the
+// Python twin is `ed25519_rule_reason` in `src/sanning_proof/ed25519_rule.py`
+// and the Go kernel's `verifyEd25519Strict` in sanning-io/agent `pkg/proof`.
+// Several clauses are ones noble 3 refuses on its own; they are checked here
+// anyway so the refusal names the clause, which a library's `false` cannot.
+
+/** The sentence a refused signature reads in an envelope result. */
+export const SIGNATURE_FAILED = "Ed25519 signature verification failed";
+
+export const ED25519_RULE_REASONS = [
+  "the public key is not the canonical encoding of a point",
+  "the public key is a point of small order",
+  "the public key is not in the prime-order subgroup",
+  "R is not the canonical encoding of a point",
+  "R is the identity",
+  "R is a point of small order",
+  "R is not in the prime-order subgroup",
+  "S is not below the group order",
+] as const;
+
+const [
+  KEY_NOT_CANONICAL,
+  KEY_SMALL_ORDER,
+  KEY_NOT_IN_SUBGROUP,
+  R_NOT_CANONICAL,
+  R_IDENTITY,
+  R_SMALL_ORDER,
+  R_NOT_IN_SUBGROUP,
+  S_NOT_BELOW_L,
+] = ED25519_RULE_REASONS;
+
+const ED25519_L = 2n ** 252n + 27742317777372353535851937790883648493n;
+
+function bytesToNumberLE(bytes: Uint8Array): bigint {
+  let v = 0n;
+  for (let i = bytes.length - 1; i >= 0; i--) v = (v << 8n) | BigInt(bytes[i]);
+  return v;
+}
+
+// `Point.fromBytes(..., false)` is RFC 8032 decoding with its two strict
+// branches: it throws on y at or above p and on x zero with the sign bit set,
+// the two non-canonical encodings of a point, and on bytes that are no point.
+function decodeStrict(bytes: Uint8Array): ed.Point | null {
+  try {
+    return ed.Point.fromBytes(bytes, false);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The clause of the rule that (`publicKey`, `signature`) breaks, or `null`
+ * when it breaks none and the equation is what is left to check. Lengths are
+ * the caller's (32 and 64 bytes). Never throws.
+ */
+export function ed25519RuleReason(signature: Uint8Array, publicKey: Uint8Array): string | null {
+  const A = decodeStrict(publicKey);
+  if (A === null) return KEY_NOT_CANONICAL;
+  if (A.isSmallOrder()) return KEY_SMALL_ORDER;
+  if (!A.isTorsionFree()) return KEY_NOT_IN_SUBGROUP;
+  const R = decodeStrict(signature.subarray(0, 32));
+  if (R === null) return R_NOT_CANONICAL;
+  if (R.is0()) return R_IDENTITY;
+  if (R.isSmallOrder()) return R_SMALL_ORDER;
+  if (!R.isTorsionFree()) return R_NOT_IN_SUBGROUP;
+  if (bytesToNumberLE(signature.subarray(32, 64)) >= ED25519_L) return S_NOT_BELOW_L;
+  return null;
+}
+
+/**
+ * `null` iff `signatureHex` is a signature of `message` under `publicKeyHex`
+ * by the rule; otherwise the sentence the refusal reads: `SIGNATURE_FAILED`,
+ * with `": "` and the clause of the rule it broke when it broke one. A
+ * malformed field, a wrong length and an equation that does not hold read
+ * the bare sentence. Never throws. The Python twin is `ed25519_refusal`.
+ */
+export async function ed25519Refusal(
+  message: Uint8Array,
+  signatureHex: string,
+  publicKeyHex: string,
+): Promise<string | null> {
+  let signature: Uint8Array;
+  let publicKey: Uint8Array;
+  try {
+    signature = hexToBytes(signatureHex);
+    publicKey = hexToBytes(publicKeyHex);
+  } catch {
+    return SIGNATURE_FAILED;
+  }
+  if (signature.length !== 64 || publicKey.length !== 32) return SIGNATURE_FAILED;
+  const reason = ed25519RuleReason(signature, publicKey);
+  if (reason !== null) return `${SIGNATURE_FAILED}: ${reason}`;
+  try {
+    return (await ed.verifyAsync(signature, message, publicKey, { zip215: false })) ? null : SIGNATURE_FAILED;
+  } catch {
+    return SIGNATURE_FAILED;
+  }
+}
+
+// Verify an Ed25519 signature by the rule above. Inputs are hex (signature,
+// public key) as they appear in the envelope; message is raw bytes. Never
+// throws — a malformed signature or key is "not verified," not an exception,
+// so a hostile envelope can't crash the checker.
 // Arguments in the Python twin's order, `ed25519_verify(message,
 // signature_hex, public_key_hex)` (P-03, 0.13.0). The message came second
 // until 0.13.0; a caller that still passes the signature first gets a compile
@@ -89,22 +206,14 @@ export async function ed25519Verify(
   signatureHex: string,
   publicKeyHex: string,
 ): Promise<boolean> {
-  try {
-    // zip215:false → strict RFC-8032 verification, matching the Go agent's
-    // crypto/ed25519 exactly (noble defaults to the more lenient zip215:true).
-    return await ed.verifyAsync(hexToBytes(signatureHex), message, hexToBytes(publicKeyHex), {
-      zip215: false,
-    });
-  } catch {
-    return false;
-  }
+  return (await ed25519Refusal(message, signatureHex, publicKeyHex)) === null;
 }
 
 // Ed25519 SIGN the raw `message` bytes with a 32-byte private-key seed (lowercase
 // hex). Returns the signature as lowercase hex. The signing counterpart to
 // ed25519Verify — the ONE signing primitive the composer (`proof export`,
 // evidence-export.md §5) needs to Ed25519-sign the export wrapper with the
-// exporter's key ("anyone can export", P-4). The @noble sha512Async hook wired at
+// exporter's key ("anyone can export", P-4). The @noble sha512Async provider wired at
 // module load serves signing and verification alike, so this stays WebCrypto-only.
 export async function ed25519Sign(message: Uint8Array, privateKeyHex: string): Promise<string> {
   return bytesToHex(await ed.signAsync(message, hexToBytes(privateKeyHex)));

package/src/index.ts

@@ -28,6 +28,7 @@ export {
 export {
   bytesToHex,
   deriveOperatorAddress,
+  ed25519Refusal,
   ed25519Verify,
   hexToBytes,
   sha256Bytes,

package/src/verifier.ts

@@ -9,7 +9,7 @@
 
 import canonicalize from "canonicalize";
 
-import { ed25519Verify, isHexField, sha256Hex, utf8 } from "./crypto.js";
+import { SIGNATURE_FAILED, ed25519Refusal, isHexField, sha256Hex, utf8 } from "./crypto.js";
 import type { ContentRole, Envelope, VerificationResult, VerifyOptions } from "./types.js";
 
 // Fail-closed accepted-profile registry (envelope-spec §2): exactly the
@@ -835,16 +835,20 @@ async function verifyEnvelopeChecked(
   // invalidating the primary signature; the field is reserved/default-absent.
   // The corpus has no co-signed vectors, so this strip is pinned by an explicit
   // unit test rather than by conformance.
+  // The refusal names the clause of the Ed25519 rule a signature breaks
+  // (envelope-spec §7, A44), so a forged shape reads differently from a
+  // corrupted byte; an equation that does not hold reads the bare sentence.
   let signatureOk = false;
   try {
     const { signature: _signature, co_signatures: _coSignatures, ...envelopeForSig } = env;
-    signatureOk = await ed25519Verify(utf8(jcs(envelopeForSig)), env.signature, env.public_key);
-    if (!signatureOk) errors.push("Ed25519 signature verification failed");
+    const refusal = await ed25519Refusal(utf8(jcs(envelopeForSig)), env.signature, env.public_key);
+    signatureOk = refusal === null;
+    if (refusal !== null) errors.push(refusal);
   } catch {
     // The sentence the Python kernel writes for the same failure. What was
     // thrown is the host's wording (`jcs: input nesting exceeds ...`), and a
     // public result carries the kernel's own words only (proof#150).
-    errors.push("Ed25519 signature verification failed");
+    errors.push(SIGNATURE_FAILED);
   }
 
   // Check 3 (optional) — Content Bind: the user's bytes match a hash this