@xmbl/simulator 0.1.11 → 0.1.13

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.1.13
+
+### Patch Changes
+
+- **SECURITY — the AIR zero-knowledge path leaked the entire secret trace.** Reported against
+  0.1.12 and reproduced: the batching challenges `alpha` and `beta` are public and the composition
+  `C(x) = alpha*u + beta*v` is an `F_p^4` element over two base-field unknowns, so every FRI opening
+  was four equations in two unknowns. Solving two limbs for `v` gives `col'(x)` directly, and the
+  `2*nq` layer-0 openings interpolate the blinded trace column — row 0 IS the witness. It returned
+  the secret exactly, in about a second. The `(x^T - 1)` blind could not help: it is sized for the
+  `2*nc` direct openings and vanishes on the trace domain by construction.
+
+  The composition is now MASKED before FRI sees it: a uniformly random extension-valued polynomial
+  `M` of degree `< K` is committed first, `gamma` is drawn from a transcript that includes its root,
+  and FRI runs on `C + gamma*M`. Each opening is four equations in six unknowns. The verifier opens
+  `M` against its own root at the consistency points. A mask that is not of degree `< K` would pin
+  `gamma` to one value out of ~2^124, so masking cannot hide a false statement.
+
+  `setup` now doubles `K` until it exceeds everything the transcript reveals
+  (`nq*(log2 K + 1) + nc`, plus margin): `K = 2048`, `N = 16384`. `nc` is raised 16 -> 40, because
+  each consistency point is `-log2(K/N) = 3` bits and `nc = 16` was a ~48-bit check behind a
+  ~100-bit FRI. Coset evaluation is now an NTT, so proving is faster than 0.1.12 despite the larger
+  domain. **PROOFS FROM 0.1.12 DO NOT VERIFY ON 0.1.13** — the proof carries new commitments
+  (`rootM`, `rootD`) and the derived parameters moved.
+
+  `xzk` (the cube-curve statement) was attacked the same way and survives: the committed curve is
+  fully recoverable from its FRI openings, but `Pt = P + Z_R*B` with `B` uniform of degree 18 over a
+  witness quotient of degree 1, so the same proof is carried by a 2-parameter family of witnesses.
+
+  The attack is now a permanent check in `air.test.mjs` and `xzk.test.mjs`.
+
+## 0.1.12
+
 ## 0.1.11
 
 ### Patch Changes
@@ -18,7 +51,7 @@
     never under the xid it claims (a datum fails `validateXid` precisely when that xid is somebody else's), and
     the anchor dedup key claimed before validation is released on every failure. Both doors are closed on BOTH
     entry points — `addTransaction` and `addSealedBatch`, the path a finalized transaction actually takes — and
-    one invalid entry in a batch no longer discards the honest transactions behind it.
+    one invalid entry in a batch no longer discards the genuine transactions behind it.
   - consensus: a content-addressed type-6 value tx is admitted on its content address (it carries no in-body
     signature by design); a malformed anchor is refused at the door by the ledger's own `validateTransaction`;
     `finalizeTransaction` preserves the signed `id`.
@@ -28,7 +61,7 @@
   - networking: self-elected circuit-relay server; NO_FATAL transport tolerance; throttled bootstrap warnings.
   - storage-compute: `CoordinateDelivery` (broken: `require` in ESM, keyed on the public key) is removed.
   - core: ships the node daemon as the `xmbl-node` bin; the control socket implements the coordinator
-    contract (`xsc`, `submit_batch`, `ledger_capabilities`, `identity_status`, a signed `chain` claim, honest
+    contract (`xsc`, `submit_batch`, `ledger_capabilities`, `identity_status`, a signed `chain` claim, genuine
     `submit_tx` rejections) and reports the RUNNING versions; boot waits for the stores.
   - every package exports a load-time `VERSION`.
   - PROTOCOL (operator, 2026-09-16): every transaction is typed by its xid (tokens.json type codes; `micromineTx`/

package/DEVNET-SEAM-FINDING.md

@@ -5,7 +5,7 @@ opts into ledger-side signature verification — it wires **both** `xid` and
 `getPublicKeyByAddress` into the `Ledger` — which is precisely the caller configuration that
 exercises defects no production code path currently reaches. Two of the three defects below are
 now **FIXED**; the third is a genuine signature-domain decision left for the audit and documented
-honestly rather than papered over. All are covered by `src/devnet.test.mjs`.
+accurately rather than papered over. All are covered by `src/devnet.test.mjs`.
 
 ## Where ledger-side verification runs
 
@@ -92,7 +92,7 @@ architectural choices, **which is an audit-level signature-domain / block-identi
 Both touch `block.js`, ledger dedup, and cross-node determinism, so neither rides in on a tooling
 commit. Until one is made and audited, **ledger-side re-verification stays OFF in production**
 (the `getPublicKeyByAddress` lookup is deliberately not wired into the `Ledger`), and consensus
-remains the single verification point. This is the honest, current posture — not a silent gap.
+remains the single verification point. This is the genuine, current posture — not a silent gap.
 
 ## Why the devnet drives the direct path
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmbl/simulator",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "type": "module",
   "main": "index.js",
   "description": "XMBL Simulator",

package/src/capabilities.js

@@ -2,7 +2,7 @@
 // zk / homomorphic-encryption / signature primitives in-page (they need node:crypto; an MV3 page
 // CSP and WebCrypto's async sha256 make a faithful in-page port impossible), so the devnet node
 // process — which already loads the REAL modules — runs each primitive end-to-end and returns a
-// JSON-safe verdict. Each runner does the honest thing and its NEGATIVE control in one call: it
+// JSON-safe verdict. Each runner does the right thing and its NEGATIVE control in one call: it
 // proves the capability verifies true input AND rejects tampered input, so a green card on screen
 // is backed by a real refusal, not a fabricated pass. Every flow mirrors the headless
 // reproductions in @xmbl/contracts (reproductions/contract-zk.mjs, contract-he.mjs,
@@ -25,7 +25,7 @@ const CUBE_CONTEXT = {
 
 // ── Coordinate / curve zero-knowledge (@xmbl/zero-knowledge, FRI, ⛔ UNAUDITED) ──
 // A prover shows a coordinate (derivedX, derivedY) lies on a curve through secret points, and a
-// verifier checks it WITHOUT the secret points. We prove the honest coordinate and reject a
+// verifier checks it WITHOUT the secret points. We prove the genuine coordinate and reject a
 // tampered y (derivedY+1) — the exact pair reproductions/contract-zk.mjs gates a Verkle write on.
 export function zkProof({ derivedX = 99 } = {}) {
   const ctx = setup();
@@ -34,14 +34,14 @@ export function zkProof({ derivedX = 99 } = {}) {
   const dX = bi(derivedX);
   const { Pt, derivedY } = blindedCurve(ctx, { publicPoints, secretPoints, derivedX: dX });
   const proof = prove(ctx, { Pt, publicPoints, derivedX: dX, derivedY });
-  const honest = zkVerify(ctx, { proof, publicPoints, derivedX: dX, derivedY });
+  const genuine = zkVerify(ctx, { proof, publicPoints, derivedX: dX, derivedY });
   const tampered = zkVerify(ctx, { proof, publicPoints, derivedX: dX, derivedY: derivedY + 1n });
   return {
-    ok: honest === true && tampered === false,
+    ok: genuine === true && tampered === false,
     scheme: 'xzk (FRI coordinate/curve proof, UNAUDITED)',
     derivedX: str(dX), derivedY: str(derivedY),
     publicAnchors: publicPoints.length,
-    honestVerifies: honest, tamperedRejected: tampered === false,
+    genuineVerifies: genuine, tamperedRejected: tampered === false,
     note: 'proof checked without the secret points; a coordinate off the curve is rejected',
   };
 }

package/src/devnet-rpc.js

@@ -17,7 +17,7 @@
 // It ALSO serves the node-side capability surface the extension cannot run in-page — each a REAL
 // primitive run end-to-end in this node process, verdict returned JSON-safe (see capabilities.js):
 //   getStateRoot    {type}                  → { root, pooled, landed }   // live ledger state root
-//   zkProof         {type, derivedX?}       → { ok, derivedX, derivedY, honestVerifies, tamperedRejected, … }
+//   zkProof         {type, derivedX?}       → { ok, derivedX, derivedY, genuineVerifies, tamperedRejected, … }
 //   heAdd           {type, a?, b?}          → { ok, a, b, sum, expected, … }  // homomorphic add
 //   sigVerify       {type, message?}        → { ok, signedVerifies, tamperedRejected, … }  // Cubic-SIG
 //   seal            {type, secret?}         → { ok, roundTrip, … }             // PQ KEM seal
@@ -69,7 +69,7 @@ export class DevnetRpc {
       }
       default: {
         // Node-side capability surface (zk / HE / signature / seal): a real primitive run to a
-        // verdict in this process. Unknown types still fall through to an honest error.
+        // verdict in this process. Unknown types still fall through to a genuine error.
         const cap = CAPABILITIES[message && message.type];
         if (cap) return cap(message || {});
         return { error: `Unknown message type: ${message && message.type}` };

package/src/devnet-rpc.test.mjs

@@ -54,7 +54,7 @@ try {
 
   // ── node-side capability surface: each a REAL primitive verified + negative-controlled ──
   const zk = await call({ type: 'zkProof', derivedX: 99 });
-  ok('zkProof verifies the honest coordinate and rejects the tampered one', zk.ok === true && zk.honestVerifies === true && zk.tamperedRejected === true, JSON.stringify(zk));
+  ok('zkProof verifies the genuine coordinate and rejects the tampered one', zk.ok === true && zk.genuineVerifies === true && zk.tamperedRejected === true, JSON.stringify(zk));
 
   const he1 = await call({ type: 'heAdd', a: 1, b: 0 });
   ok('heAdd: ENC(1) ⊞ ENC(0) decrypts to 1 (blind add)', he1.ok === true && he1.sum === 1, JSON.stringify(he1));

package/src/simulator.js

@@ -613,7 +613,7 @@ export class SystemSimulator extends EventEmitter {
     // Compute operations can trigger state changes. This used to call a fake
     // xvsm.executeTransaction with a comment string as "WASM"; that path is gone (real
     // contract execution is @xmbl/contracts' ContractHost over @xmbl/storage-compute). The
-    // simulator's honest job here is just to drive a state change, so it uses the real
+    // simulator's genuine job here is just to drive a state change, so it uses the real
     // state-diff path directly.
     if (this.modules.xvsm && chance.bool({ likelihood: 70 })) {
       setTimeout(() => {