@xmbl/state-machine 0.1.11 → 0.1.13

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @xmbl/state-machine
 
+## 0.1.13
+
+### Patch Changes
+
+- **SECURITY — the AIR zero-knowledge path leaked the entire secret trace.** Reported against
+  0.1.12 and reproduced: the batching challenges `alpha` and `beta` are public and the composition
+  `C(x) = alpha*u + beta*v` is an `F_p^4` element over two base-field unknowns, so every FRI opening
+  was four equations in two unknowns. Solving two limbs for `v` gives `col'(x)` directly, and the
+  `2*nq` layer-0 openings interpolate the blinded trace column — row 0 IS the witness. It returned
+  the secret exactly, in about a second. The `(x^T - 1)` blind could not help: it is sized for the
+  `2*nc` direct openings and vanishes on the trace domain by construction.
+
+  The composition is now MASKED before FRI sees it: a uniformly random extension-valued polynomial
+  `M` of degree `< K` is committed first, `gamma` is drawn from a transcript that includes its root,
+  and FRI runs on `C + gamma*M`. Each opening is four equations in six unknowns. The verifier opens
+  `M` against its own root at the consistency points. A mask that is not of degree `< K` would pin
+  `gamma` to one value out of ~2^124, so masking cannot hide a false statement.
+
+  `setup` now doubles `K` until it exceeds everything the transcript reveals
+  (`nq*(log2 K + 1) + nc`, plus margin): `K = 2048`, `N = 16384`. `nc` is raised 16 -> 40, because
+  each consistency point is `-log2(K/N) = 3` bits and `nc = 16` was a ~48-bit check behind a
+  ~100-bit FRI. Coset evaluation is now an NTT, so proving is faster than 0.1.12 despite the larger
+  domain. **PROOFS FROM 0.1.12 DO NOT VERIFY ON 0.1.13** — the proof carries new commitments
+  (`rootM`, `rootD`) and the derived parameters moved.
+
+  `xzk` (the cube-curve statement) was attacked the same way and survives: the committed curve is
+  fully recoverable from its FRI openings, but `Pt = P + Z_R*B` with `B` uniform of degree 18 over a
+  witness quotient of degree 1, so the same proof is carried by a 2-parameter family of witnesses.
+
+  The attack is now a permanent check in `air.test.mjs` and `xzk.test.mjs`.
+
+## 0.1.12
+
 ## 0.1.11
 
 ### Patch Changes
@@ -18,7 +51,7 @@
     never under the xid it claims (a datum fails `validateXid` precisely when that xid is somebody else's), and
     the anchor dedup key claimed before validation is released on every failure. Both doors are closed on BOTH
     entry points — `addTransaction` and `addSealedBatch`, the path a finalized transaction actually takes — and
-    one invalid entry in a batch no longer discards the honest transactions behind it.
+    one invalid entry in a batch no longer discards the genuine transactions behind it.
   - consensus: a content-addressed type-6 value tx is admitted on its content address (it carries no in-body
     signature by design); a malformed anchor is refused at the door by the ledger's own `validateTransaction`;
     `finalizeTransaction` preserves the signed `id`.
@@ -28,7 +61,7 @@
   - networking: self-elected circuit-relay server; NO_FATAL transport tolerance; throttled bootstrap warnings.
   - storage-compute: `CoordinateDelivery` (broken: `require` in ESM, keyed on the public key) is removed.
   - core: ships the node daemon as the `xmbl-node` bin; the control socket implements the coordinator
-    contract (`xsc`, `submit_batch`, `ledger_capabilities`, `identity_status`, a signed `chain` claim, honest
+    contract (`xsc`, `submit_batch`, `ledger_capabilities`, `identity_status`, a signed `chain` claim, genuine
     `submit_tx` rejections) and reports the RUNNING versions; boot waits for the stores.
   - every package exports a load-time `VERSION`.
   - PROTOCOL (operator, 2026-09-16): every transaction is typed by its xid (tokens.json type codes; `micromineTx`/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmbl/state-machine",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "type": "module",
   "main": "index.js",
   "exports": {

package/src/applied-count.test.mjs

@@ -1,4 +1,4 @@
-// OUTCOME TEST: applied_tx_count after the convergence primitive. The metric the whole fleet reads.
+// OUTCOME TEST: applied_tx_count after the convergence primitive. The metric every node reads.
 const { StateMachine } = await import("../index.js");
 const sm = new StateMachine({ dbPath: null });
 sm._dbOpen = false;

package/src/apply-path.test.mjs

@@ -50,7 +50,7 @@ const close = async ({ dir, xclt, xvsm }) => {
 console.log('\n1. a SEALED face reaches the state tree (the missing block:added doorbell)');
 {
   const env = await fresh();
-  await check('the tree starts empty — the honest baseline, not an assumption', async () => {
+  await check('the tree starts empty — the true baseline, not an assumption', async () => {
     eq(env.xvsm.getStateRoot(), ZERO, 'initial root');
   });
   await check('sealing 9 txs moves state_root off zero and applies 9 diffs', async () => {

package/src/rehydration.test.mjs

@@ -1,4 +1,4 @@
-// THE THREE DEFECTS THAT KEPT NODES OFF A SHARED ROOT, each asserted by the symptom the fleet showed,
+// THE THREE DEFECTS THAT KEPT NODES OFF A SHARED ROOT, each asserted by the symptom the nodes showed,
 // not by the mechanism. All three were measured live on 2026-09-15 before being fixed here.
 import { test } from 'node:test';
 import assert from 'node:assert';
@@ -25,7 +25,7 @@ test('a restarted node publishes a REAL root, not 64 zeros, from the state: keys
   await sm.db.close();
 
   // Reopen. The diff replay is NOT the thing under test — delete every diff row first, so the only
-  // surviving source for the trie is `state:`. 39 of 44 reporting fleet nodes published ZERO here.
+  // surviving source for the trie is `state:`. 39 of 44 reporting nodes published ZERO here.
   sm = await open(dir);
   await sm.db.clear({ gte: 'diff:', lt: 'diff:\xFF' });
   await sm.db.close();
@@ -73,7 +73,7 @@ test('legacy rows keyed by block id are re-keyed to content identity on the next
   const dir = `/tmp/xvsm-rehydrate-${process.pid}-d`;
   rmSync(dir, { recursive: true, force: true });
   let sm = await open(dir);
-  // Write rows the way every node on the fleet already has them: one per submission, keyed by block id.
+  // Write rows the way every node on the nodes already has them: one per submission, keyed by block id.
   const set = anchors(40);
   let written = 0;
   for (let pass = 0; pass < 3; pass++) for (const a of set) {

package/src/state-machine.js

@@ -34,7 +34,7 @@ export class StateMachine extends EventEmitter {
     
     // Initialize database. KEEP THE PROMISE: `_dbOpen` flips true the moment Level opens, long before the
     // diff sweep and the tree rehydration have finished, so anything that polls `_dbOpen` and then reads a
-    // count is reading a store mid-rebuild. `ready()` is the only honest join point.
+    // count is reading a store mid-rebuild. `ready()` is the only genuine join point.
     this._ready = this._initDb().catch(() => {});
     
     // Listen to ledger events if available
@@ -335,9 +335,9 @@ export class StateMachine extends EventEmitter {
     // ⛔ RECORD A DIFF FOR EVERY ANCHOR APPLIED, or applied_tx_count IS ZERO BY CONSTRUCTION. This loop wrote
     // straight into the tree and never touched `this.diffs`, which it had just emptied — and
     // getStatistics().totalTransactions is transactionLog.length + diffs.length. So the moment a node runs the
-    // convergence primitive, the number the whole fleet reads as "is this node applying anything" resets to 0
+    // convergence primitive, the number every node reads as "is this node applying anything" resets to 0
     // and STAYS 0 no matter how many anchors it applied. MEASURED 2026-09-15: this node held a correct root
-    // over 3,941 applied anchors and published applied_tx_count 0; across the fleet 42 of 46 reporting nodes
+    // over 3,941 applied anchors and published applied_tx_count 0; across the nodes 42 of 46 reporting nodes
     // read 0, and a design ruling was written on the premise that 41 of them had "applied nothing". They had.
     // The diff is not bookkeeping — it is the same StateDiff the block path records, keyed by the anchor's own
     // content, so a rebuild and a live apply of the same anchor upsert to ONE row rather than two.

package/src/verkle-independent-verify.test.mjs

@@ -9,7 +9,7 @@
 //   leaf hash            = sha256(value canonicalised)            (value node at depth 32)
 //   internal node hash   = sha256( concat of 256 child slots, each 32 bytes; empty slot = 32 zeros )
 //   a key's nibble at depth d = sha256(key)[d]
-// A proof carries, per level, the sibling hashes at that node; the honest verifier fills the key's own
+// A proof carries, per level, the sibling hashes at that node; the correct verifier fills the key's own
 // slot with the hash carried up from below and every other slot from the siblings (or zeros), hashes,
 // and repeats to the root. The proof is SOUND iff the reconstructed root equals the tree's real root —
 // which the verifier learns independently (tree.getRoot()), never from the attacker-supplied proof.root.

package/src/verkle-integration.test.mjs

@@ -10,7 +10,7 @@ import { join } from 'path';
 let pass = 0, fail = 0;
 const check = async (n, f) => { try { await f(); console.log(`  ok   ${n}`); pass++; } catch (e) { console.log(`  FAIL ${n}\n       ${e.message}`); fail++; } };
 const EMPTY = '0'.repeat(64);
-// Portable: this suite runs on the laptop AND on every Linux box in the fleet — so it JOINS on `ready()`
+// Portable: this suite runs on the laptop AND on every Linux box among the nodes — so it JOINS on `ready()`
 // rather than sleeping. A fixed timeout is a guess about someone else's scheduler: this suite waited
 // 120/150/250/500ms for the store to open and the tree to rehydrate, which held on this laptop and LOST on
 // ubuntu-latest, where the restart check read 64 zeros — the 150ms wait expired before `_initDb` had opened

package/src/verkle-tree.js

@@ -53,7 +53,7 @@ export class VerkleStateTree {
     // `this.root` a fresh empty VerkleNode. So a node that had loaded EVERY key off disk answered getRoot()
     // with 64 zeros: a tree that holds the whole state and commits to nothing. MEASURED 2026-09-15: after a
     // canonical rebuild of 10 anchors, restart loaded all 10 keys and published root 0000…0000; across the
-    // fleet 39 of 44 reporting nodes published exactly that, including one with 11,691 blocks persisted. The
+    // nodes 39 of 44 reporting nodes published exactly that, including one with 11,691 blocks persisted. The
     // only boxes showing a real root were showing it by accident, via XVSM's diff replay re-inserting keys
     // through insert(). The state map is not the commitment — the hashed trie over it is, and it has to be
     // reconstructed on open or every restart silently un-commits the node's entire state.
@@ -201,7 +201,7 @@ export class VerkleStateTree {
   // transactions instead of the structure that actually commits them. This returns the real nodes and the
   // real parent->child edges, bounded, with the counts needed to say what was left out.
   //
-  // Bounded on BOTH axes and honest about it: `maxDepth` limits how far down, `maxNodes` caps the total, and
+  // Bounded on BOTH axes and genuine about it: `maxDepth` limits how far down, `maxNodes` caps the total, and
   // the result carries `truncated` plus each node's own `descendants` so a cut branch reports its real size
   // rather than looking like a leaf. A viewer that silently stopped at 500 nodes would draw a tree that is
   // simply the wrong shape.
@@ -217,7 +217,7 @@ export class VerkleStateTree {
     }
     if (!start.hash) this._updateHash(start);
 
-    // Subtree size is what makes a truncated branch honest, so it is computed for every node we emit.
+    // Subtree size is what makes a truncated branch genuine, so it is computed for every node we emit.
     const sizeOf = (node) => {
       let n = 1;
       for (const c of node.children.values()) n += sizeOf(c);