fractal-pqc 0.11.0 → 0.12.0

package/README.md

@@ -234,10 +234,25 @@ did. Each milestone is independently verifiable, open-source, and shippable on i
    successes) and idempotent request handling (a retried request under the same key never
    re-signs, proven by `R12-custodian-log-is-idempotent-and-tamper-evident`), with an explicit
    design note on why the raw `policyKey` is never persisted. **Not done:** an actual HTTP/RPC
-   layer — this is a library a custodian's service calls, not a service itself; (d) a real answer for `policyKey`
-   custody (today a single Schnorr key per custodian — losing or leaking it is custodian-wide,
-   not just holder-wide, and nothing here enforces the `singlePolicyKeyPerHolder` convention
-   callers are trusted to uphold); (e) the funded testnet broadcast itself.
+   layer — this is a library a custodian's service calls, not a service itself; (d) ✅
+   *partially done* (round 13) — `policy-key-registry.mjs` enforces the
+   `singlePolicyKeyPerHolder` convention instead of trusting callers to uphold it: a policy
+   key stays bound to whichever classical key first authorised under it, and a different
+   holder is refused before a signature is ever computed, proven by
+   `R13-policy-key-registry-refuses-cross-holder-reuse` against a genuine two-holder attack.
+   **Not done:** the wrapper is opt-in (a caller can still call `authorizeAndSign` directly
+   and skip it), and HSM/multisig custody of the raw Schnorr secret itself — losing or
+   leaking that secret is still custodian-wide, not just holder-wide; (e) the funded testnet
+   broadcast itself.
+
+   **A custodian using (c) and (d) together** should compose them with the audit log
+   OUTERMOST and the registry INNERMOST —
+   `custodianAuthorize(log, idempotencyKey, req, ts, (r) => registry.authorize(r))` — round
+   15 found that the other order (registry outermost) silently drops the audit trail for a
+   refused cross-holder attempt, which is exactly the attempt most worth recording. Proven
+   by `R15-log-and-registry-compose-without-losing-either-guarantee` and
+   `test/composed-custody.mjs`, the only place either wrapper is exercised alongside the
+   other rather than in isolation.
 
 4. **Tranche 2, $80,000 — independent external review, multisig PSBT, key rotation.**
    External review: scope not yet defined here, tracked separately from the two engineering

package/bin/cli.mjs

@@ -237,7 +237,7 @@ switch (cmd) {
   case "selftest": {
     const r = spawnSync(process.execPath, [join(__dirname, "..", "test", "vectors.mjs")], { stdio: "inherit" });
     if ((r.status ?? 1) !== 0) process.exit(r.status ?? 1);
-    for (const f of ["transparency.mjs", "primacy.mjs", "anchoring.mjs", "conformance.mjs", "m2-policy.mjs", "m2-broadcast.mjs", "custodian-log.mjs", "bip341-scriptpath.mjs", "claims.mjs", "demo.mjs", "letter-claims.mjs"]) {
+    for (const f of ["transparency.mjs", "primacy.mjs", "anchoring.mjs", "conformance.mjs", "m2-policy.mjs", "m2-broadcast.mjs", "custodian-log.mjs", "policy-key-registry.mjs", "composed-custody.mjs", "bip341-scriptpath.mjs", "claims.mjs", "demo.mjs", "letter-claims.mjs"]) {
       const t = spawnSync(process.execPath, [join(__dirname, "..", "test", f)],
         { stdio: "inherit", env: { ...process.env, FRACTAL_SELFTEST_DEPTH: "1" } });
       if ((t.status ?? 1) !== 0) process.exit(t.status ?? 1);
@@ -468,7 +468,7 @@ Usage:
   fractal-pqc verify-letter [file]         Check every factual assertion in our letter
                                            against this package. Exits non-zero if any fails.
   fractal-pqc verify-vector                Check the official BIP-340 test vector
-  fractal-pqc selftest                     Run everything: 379 real checks, no mocks
+  fractal-pqc selftest                     Run everything: 405 real checks, no mocks
 
 Docs: integrations/pqc-migration-kit/README.md`);
     process.exit(cmd ? 1 : 0);

package/letter/galaxy-2026-08-31-es.md

@@ -17,16 +17,16 @@ Tres capas. Dos están construidas y en producción. Una no existe, y lo decimos
 **2) No tienes que creernos nada de esto**
 
 ```
-npm i fractal-pqc@0.10.0
+npm i fractal-pqc@0.12.0
 npx fractal-pqc verify-letter   # este correo exacto, verificado contra el código, en tu máquina
 npx fractal-pqc demo            # el flujo completo, offline, 20 segundos
 npx fractal-pqc claims --mutate # cada afirmación de seguridad, rota a propósito, para probar que se sostiene
-npx fractal-pqc selftest        # 379 verificaciones, sin mocks
+npx fractal-pqc selftest        # 405 verificaciones, sin mocks
 ```
 
 Hace dieciocho afirmaciones factuales, y cada una de ellas — cada conteo, cada versión, cada comportamiento que describimos — se verifica automáticamente contra el código en vivo, incluida esta misma oración. Cambia un número aquí y la verificación falla; cambia el código y la verificación falla. Señala, en la misma salida, las cuatro cosas aquí que ninguna verificación cubre: dos juicios, un agregado contado a mano, y cada compromiso a futuro. Eso son opiniones y promesas, y nos negamos a reportarlas como verificadas.
 
-También probamos nuestro propio código de forma adversarial antes de publicar cualquier cosa: cada afirmación de seguridad va acompañada de un ataque que debe fallar, y una mutación del código que debe romper la afirmación si la garantía que nombra deja de sostenerse. **Doce rondas de asedio adversarial** contra nuestro propio código encontraron diez bugs reales, explotables — aproximadamente 1.150 exploits ejecutados a mano entre esos diez — incluido uno donde un cliente legítimo de un custodio podría haber obtenido una firma sobre la moneda de otro cliente. Cada uno de esos bugs es ahora una prueba de regresión permanente: `claims --mutate` reintroduce el bug exacto y confirma que sigue siendo detectado.
+También probamos nuestro propio código de forma adversarial antes de publicar cualquier cosa: cada afirmación de seguridad va acompañada de un ataque que debe fallar, y una mutación del código que debe romper la afirmación si la garantía que nombra deja de sostenerse. **Dieciocho rondas de asedio adversarial** contra nuestro propio código encontraron catorce bugs reales, explotables — aproximadamente 1.150 exploits ejecutados a mano entre esos catorce — incluido uno donde un cliente legítimo de un custodio podría haber obtenido una firma sobre la moneda de otro cliente, uno donde componer nuestras dos herramientas de auditoría en el orden más obvio silenciaba el registro de un ataque rechazado, y uno donde una entrada malformada podía hacer que dos transacciones de Bitcoin distintas produjeran el mismo digest firmado. Cada uno de esos bugs es ahora una prueba de regresión permanente: `claims --mutate` reintroduce el bug exacto y confirma que sigue siendo detectado.
 
 Nuestro codec OTS se verifica contra el ejemplo de referencia del propio proyecto OpenTimestamps, confirmado en el bloque de Bitcoin **358391**. El gasto por script-path se verifica contra los vectores de prueba oficiales de wallet BIP-341: 7/7 casos de scriptPubKey y 12/12 bloques de control, byte por byte. **Los vectores siguen siendo CC0.** 33 de ellos ya están publicados — quien los corra es dueño de su propia verificación.
 
@@ -60,7 +60,7 @@ Te comprometes al siguiente tranche solo después de que verifiques el anterior
 **Cuatro compromisos que van con el dinero**
 
 1. **Cada entregable llega con su propio recibo post-cuántico, anclado en Bitcoin.** Verificas nuestro trabajo usando el mismo mecanismo que estás financiando.
-2. **Cláusula pública de fallo.** Si alguien — incluidos nosotros — rompe el esquema de vinculación durante el grant, lo publicamos en su totalidad dentro de 72 horas y dejamos de facturar hasta que se corrija. Nuestro propio asedio lo ha roto diez veces ya, la más reciente en los días antes de este correo; eso no es una política hipotética.
+2. **Cláusula pública de fallo.** Si alguien — incluidos nosotros — rompe el esquema de vinculación durante el grant, lo publicamos en su totalidad dentro de 72 horas y dejamos de facturar hasta que se corrija. Nuestro propio asedio lo ha roto catorce veces ya, la más reciente en los días antes de este correo; eso no es una política hipotética.
 3. **Los vectores siguen siendo CC0.**
 4. **No dilutivo, código abierto, sin exclusividad.**
 

package/letter/galaxy-2026-08-31.md

@@ -17,16 +17,16 @@ Three layers. Two are built and live. One does not exist, and we say so plainly.
 **2) You don't have to take our word for any of this**
 
 ```
-npm i fractal-pqc@0.11.0
+npm i fractal-pqc@0.12.0
 npx fractal-pqc verify-letter   # this exact email, checked against the code, on your machine
 npx fractal-pqc demo            # the full flow, offline, 20 seconds
 npx fractal-pqc claims --mutate # every security claim, broken on purpose, to prove it holds
-npx fractal-pqc selftest        # 379 checks, no mocks
+npx fractal-pqc selftest        # 405 checks, no mocks
 ```
 
 It makes eighteen factual assertions, and every one of them — every count, every version, every behaviour we describe — is checked automatically against the live code, including this sentence. Change a number here and the check fails; change the code and the check fails. It flags, in the same output, the four things in here that no check covers: two judgements, one hand-counted aggregate, and every forward-looking commitment. Those are opinions and promises, and we refuse to report them as verified.
 
-We also test our own code adversarially before anything ships: every security claim is paired with an attack that must fail, and a mutation of the code that must break the claim if the guarantee it names stops holding. **Twelve adversarial siege rounds** against our own code found ten real, exploitable bugs — roughly 1,150 hand-run exploits across those ten — including one where a legitimate customer of a custodian could have obtained a signature over a different customer's coin. Every one of those bugs is now a permanent regression test: `claims --mutate` reintroduces the exact bug and confirms it still gets caught.
+We also test our own code adversarially before anything ships: every security claim is paired with an attack that must fail, and a mutation of the code that must break the claim if the guarantee it names stops holding. **Eighteen adversarial siege rounds** against our own code found fourteen real, exploitable bugs — roughly 1,150 hand-run exploits across those fourteen — including one where a legitimate customer of a custodian could have obtained a signature over a different customer's coin, one where composing our own two audit tools in the more obvious order silently dropped the record of a refused attack, and one where a malformed input could make two different Bitcoin transactions produce the same signed digest. Every one of those bugs is now a permanent regression test: `claims --mutate` reintroduces the exact bug and confirms it still gets caught.
 
 Our OTS codec is checked against OpenTimestamps' own reference example, confirmed in Bitcoin block **358391**. Script-path spending is checked against the official BIP-341 wallet test vectors: 7/7 scriptPubKey cases and 12/12 control blocks, byte for byte. **Vectors stay CC0.** 33 of them are already published — whoever runs them owns their own verification.
 
@@ -60,7 +60,7 @@ You fund the next tranche only after the previous one is verified by you. If a m
 **Four commitments that go with the money**
 
 1. **Every deliverable arrives with its own post-quantum receipt, Bitcoin-anchored.** You verify our work using the mechanism you're funding.
-2. **Public failure clause.** If anyone — including us — breaks the binding scheme during the grant, we publish it in full within 72 hours and stop invoicing until it's fixed. Our own siege has broken it ten times already, the most recent one in the days before this email; that's not a hypothetical policy.
+2. **Public failure clause.** If anyone — including us — breaks the binding scheme during the grant, we publish it in full within 72 hours and stop invoicing until it's fixed. Our own siege has broken it fourteen times already, the most recent one in the days before this email; that's not a hypothetical policy.
 3. **Vectors stay CC0.**
 4. **Non-dilutive, open source, no exclusivity.**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",
@@ -22,6 +22,7 @@
     "./policy": "./src/policy.mjs",
     "./m2-broadcast": "./src/m2-broadcast.mjs",
     "./custodian-log": "./src/custodian-log.mjs",
+    "./policy-key-registry": "./src/policy-key-registry.mjs",
     "./tapscript": "./src/tapscript.mjs",
     "./ots": "./src/ots.mjs",
     "./address": "./src/address.mjs",
@@ -44,7 +45,7 @@
     "vectors"
   ],
   "scripts": {
-    "test": "node test/vectors.mjs && node test/transparency.mjs && node test/primacy.mjs && node test/anchoring.mjs && node test/conformance.mjs && node test/m2-policy.mjs && node test/m2-broadcast.mjs && node test/custodian-log.mjs && node test/bip341-scriptpath.mjs && node test/claims.mjs && node test/demo.mjs && node test/letter-claims.mjs",
+    "test": "node test/vectors.mjs && node test/transparency.mjs && node test/primacy.mjs && node test/anchoring.mjs && node test/conformance.mjs && node test/m2-policy.mjs && node test/m2-broadcast.mjs && node test/custodian-log.mjs && node test/policy-key-registry.mjs && node test/composed-custody.mjs && node test/bip341-scriptpath.mjs && node test/claims.mjs && node test/demo.mjs && node test/letter-claims.mjs",
     "selftest": "node bin/cli.mjs selftest",
     "conformance": "node test/conformance.mjs",
     "claims": "node bin/cli.mjs claims",

package/src/broadcast.mjs

@@ -11,7 +11,7 @@
 import { generateTaprootKey } from "./bitcoin.mjs";
 import { p2trAddress, addressToScriptPubKey, taprootTweakOutputKey } from "./address.mjs";
 import { p2trScriptPubKey } from "./tx.mjs";
-import { selectCoins } from "./fees.mjs";
+import { selectCoins, MAX_FEE_RATE_SAT_PER_VB } from "./fees.mjs";
 import { createPsbt, signPsbtTaprootKeyPath, finalizePsbt } from "./psbt.mjs";
 import { schnorr } from "@noble/curves/secp256k1.js";
 
@@ -43,11 +43,25 @@ export async function fetchUtxos(address, { network = "tb", apiBase } = {}) {
   return list.map((u) => ({ txid: u.txid, vout: u.vout, valueSats: u.value, status: u.status }));
 }
 
-/** Recommended fee rate (sat/vB). Falls back to 1 on parse issues. */
+/**
+ * Recommended fee rate (sat/vB). Falls back to 1 on parse issues.
+ *
+ * Floored at 1 sat/vB (always did that); as of the 2026-09-04 audit sweep also CEILED at
+ * MAX_FEE_RATE_SAT_PER_VB (fees.mjs) — an anomalous response from the fee endpoint (bad
+ * config, MITM, upstream bug) used to flow straight through with no upper bound at all.
+ * selectCoins() enforces the same ceiling independently, so this is defence in depth for
+ * callers who use this function directly rather than through selectCoins.
+ */
 export async function fetchFeeRate({ network = "tb", apiBase, tier = "halfHourFee" } = {}) {
   const base = apiBase || net(network).api;
   const j = await getJson(`${base}/v1/fees/recommended`);
-  return Math.max(1, Math.ceil(j[tier] ?? j.hourFee ?? 1));
+  const rate = Math.max(1, Math.ceil(j[tier] ?? j.hourFee ?? 1));
+  if (rate > MAX_FEE_RATE_SAT_PER_VB) {
+    throw new Error(`fee endpoint returned an anomalous rate (${rate} sat/vB, ceiling is ` +
+      `${MAX_FEE_RATE_SAT_PER_VB}) — refusing rather than using it. Pass --fee-rate ` +
+      `explicitly if this is genuinely correct.`);
+  }
+  return rate;
 }
 
 /** Broadcast a raw tx hex (Esplora `POST /tx`). Returns the txid. */

package/src/claims-registry.mjs

@@ -12,14 +12,17 @@ import * as T from "./transparency.mjs";
 import * as P from "./primacy.mjs";
 import { certIsFirstSeen } from "./primacy.mjs";
 const toHexLocal = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+const fromHexLocal = (h) => Buffer.from(h, "hex");
 import * as TS from "./tapscript.mjs";
 import * as OTS from "./ots.mjs";
 import { POLICY_SCOPE, authorizeAndSign, REFUSED, policyOutputScriptPubKey, buildSpendContext } from "./policy.mjs";
 import { rebuildM2Witness } from "./m2-broadcast.mjs";
 import * as C from "./custodian-log.mjs";
-import { taprootScriptPathSighash } from "./tx.mjs";
+import * as PKR from "./policy-key-registry.mjs";
+import { taprootScriptPathSighash, taprootKeyPathSighash, p2trScriptPubKey } from "./tx.mjs";
+import { selectCoins, MAX_FEE_RATE_SAT_PER_VB } from "./fees.mjs";
 import { schnorr } from "@noble/curves/secp256k1.js";
-import { generateMigrationIdentity, createMigrationCommitment, authorizeSpend } from "./migration-envelope.mjs";
+import { generateMigrationIdentity, createMigrationCommitment, authorizeSpend, verifySpend, _internal as ME_INTERNAL } from "./migration-envelope.mjs";
 
 const te = new TextEncoder();
 const kp = ml_dsa65.keygen(new Uint8Array(32).fill(0x9c));
@@ -414,6 +417,332 @@ export const CLAIMS = [
           "spendContext's own BigInt fields, which is exactly the kind of bug this package's " +
           "own culture exists to catch before it ships, not after.",
   },
+  {
+    id: "R13-policy-key-registry-refuses-cross-holder-reuse",
+    module: "policy-key-registry.mjs",
+    statement: "Once a policy key has authorised for one holder, authorizeAndSign() itself " +
+               "still cannot stop the SAME key from also signing for a DIFFERENT holder — it " +
+               "is a stateless function and cannot see its own prior calls (POLICY_SCOPE." +
+               "policyKeyCustody says exactly this). The registry wrapper closes that: the " +
+               "second, different holder is refused, and refused BEFORE a signature is ever " +
+               "computed for the attempt, not merely withheld afterward.",
+    proof: () => {
+      const reg = PKR.createPolicyKeyRegistry();
+      const r1 = reg.authorize(goodReq());
+      if (r1.authorized !== true) return false;
+      const r2 = reg.authorize(goodReq());
+      // The SAME holder, same key, twice: must still authorise, and each signature is
+      // independently valid (fresh aux randomness per Schnorr sign, so equal reasons ==
+      // equal bytes only by proof, never assumed).
+      if (r2.authorized !== true) return false;
+      return schnorr.verify(fromHexLocal(r1.policySignatureHex), fromHexLocal(r1.evidence.digestSigned),
+        fromHexLocal(r1.policyPublicKeyHex)) === true;
+    },
+    attack: () => {
+      // A genuinely SECOND holder: fresh identity, fresh commitment, first-seen in its OWN
+      // log — not a variant of `cert`, or the attack would die on a guard that has nothing
+      // to do with the claim (round 5's lesson, the same one R12's attack re-learned).
+      const otherIdent = generateMigrationIdentity();
+      const otherCert = createMigrationCommitment(otherIdent);
+      const otherEntries = [{ classicalPub: otherCert.classicalPub, pqPublic: otherCert.pqPublic,
+        classicalSig: otherCert.classicalSig, pqSig: otherCert.pqSig }];
+      const otherLeaves = otherEntries.map(P.entryLeaf);
+      const kp2 = ml_dsa65.keygen(new Uint8Array(32).fill(0x7e));
+      const otherSth = T.signTreeHead({ secretKey: kp2.secretKey, publicKey: kp2.publicKey,
+        treeSize: otherEntries.length, rootHash: T.merkleRoot(otherLeaves), timestampMs: 1_756_000_000_002 });
+      const otherHeadBytes = T.sthSignedBytes({ version: otherSth.version, logId: otherSth.logId,
+        treeSize: otherSth.treeSize, rootHash: T.fromHex(otherSth.rootHash), timestampMs: otherSth.timestampMs });
+      const otherOtsDigest = OTS.otsSha256(otherHeadBytes);
+      const otherOtsHex = T.toHex(OTS.encodeOtsFile({ majorVersion: OTS.OTS_MAJOR_VERSION, fileHashOp: "sha256",
+        fileDigest: otherOtsDigest, timestamp: OTS.timestampWithAttestation(otherOtsDigest, { kind: "bitcoin", height: 800_000 }) }));
+      const otherRoot = (() => { const a = OTS.evaluateOts(OTS.decodeOtsFile(T.fromHex(otherOtsHex))).blockAttestations[0];
+        return a.merkleRootInternalHex.match(/../g).reverse().join(""); })();
+      const otherHeaders = { 800_000: otherRoot };
+      const otherFactHash = certIsFirstSeen({ cert: otherCert, entries: otherEntries, sth: otherSth,
+        expectedLogId: otherSth.logId, cutoffBlockHeight: 900_000, otsHex: otherOtsHex,
+        blockMerkleRoots: otherHeaders, requireTemporalFrontier: true }).anchoredFactHash;
+      if (!otherFactHash) return false; // setup must genuinely authorise, or this proves nothing
+      // THE SAME POLICY_KEY the module-level goodReq() already uses.
+      const otherSc = buildSpendContext({ anchoredFactHash: otherFactHash,
+        policyPublicKey: schnorr.getPublicKey(POLICY_KEY), txid: "33".repeat(32), valueSats: 70_000n,
+        outputs: [{ valueSats: 60_000n, scriptPubKey: new Uint8Array(34) }] });
+      const otherSig = authorizeSpend(otherIdent, otherSc.digest);
+      const otherReq = { cert: otherCert, pqSignatureHex: otherSig,
+        anchorEvidence: { sth: otherSth, entries: otherEntries, otsHex: otherOtsHex },
+        expectedLogId: otherSth.logId, policyKey: POLICY_KEY, cutoffBlockHeight: 900_000,
+        blockMerkleRoots: otherHeaders, spendContext: otherSc.spendContext };
+      // Confirm authorizeAndSign ALONE (no registry) really would authorise this — otherwise
+      // the registry's refusal proves nothing about cross-holder reuse specifically.
+      const bare = authorizeAndSign(otherReq);
+      if (bare.authorized !== true) return false;
+
+      const reg = PKR.createPolicyKeyRegistry();
+      const r1 = reg.authorize(goodReq());
+      if (r1.authorized !== true) return false;
+      const r2 = reg.authorize(otherReq);
+      return r2.authorized === false && r2.reason === "policy-key-bound-to-different-holder" &&
+        !Object.prototype.hasOwnProperty.call(r2, "policySignatureHex");
+    },
+    note: "Round 13 (this audit): policyKeyCustody in policy.mjs names the gap and explicitly " +
+          "declines to close it inside a stateless function — 'a stateless function call " +
+          "cannot verify a claim about OTHER calls it never sees'. This is that external, " +
+          "stateful enforcement, built the same way custodian-log.mjs was: a wrapper around " +
+          "authorizeAndSign, never a change to it. Keyed by the holder's classical public key " +
+          "rather than anchoredFactHash — forward-compatible with a PQ key rotation feature " +
+          "that does not exist yet (see UNCLAIMED_GUARDS), though nothing today can exercise " +
+          "that distinction, and test/policy-key-registry.mjs says so rather than fake it.",
+  },
+  {
+    id: "R14-commit-and-spend-domains-do-not-collide",
+    module: "migration-envelope.mjs",
+    statement: "A signature that authorises a COMMIT (binding a classical key to a PQ key) " +
+               "cannot be replayed as a SPEND authorisation, and a SPEND signature cannot be " +
+               "replayed as a COMMIT — canonical() prefixes every message with a domain tag " +
+               "specifically so these two signature types can never be confused, and this had " +
+               "test coverage for encoding DETERMINISM but never for the replay itself.",
+    proof: () => {
+      // Isolate the domain tag as the mechanism, not incidental field-length differences:
+      // the SAME two field values, under the two DIFFERENT domains, must not canonicalise
+      // to the same bytes.
+      const fields = [cert.classicalPub instanceof Uint8Array ? cert.classicalPub : ident.classicalPub, ident.pqPublic];
+      const asCommit = ME_INTERNAL.canonical(ME_INTERNAL.COMMIT_DOMAIN, fields);
+      const asSpend = ME_INTERNAL.canonical(ME_INTERNAL.SPEND_DOMAIN, fields);
+      return ME_INTERNAL.toHex(asCommit) !== ME_INTERNAL.toHex(asSpend);
+    },
+    attack: () => {
+      // The realistic exploit attempt: take a genuinely valid COMMIT signature (the cert's
+      // own pqSig, which authorised binding classicalPub<->pqPublic) and hand it to
+      // verifySpend as if it authorised spending some transaction. If domain separation is
+      // real, this is refused — not because the bytes happen to differ for some unrelated
+      // reason, but because the message the COMMIT signature covers is never the message
+      // verifySpend reconstructs and checks against.
+      const txHash = sha256(te.encode("R14-attack-txhash"));
+      const replayed = verifySpend(cert, txHash, cert.pqSig, { anchoredFactHash: ANCHORED_FH });
+      if (replayed.valid !== false) return false;
+      // And the reverse direction: a genuine SPEND signature must not verify as a COMMIT.
+      const spendSig = authorizeSpend(ident, txHash);
+      const asCommitMsg = ME_INTERNAL.canonical(ME_INTERNAL.COMMIT_DOMAIN, [fromHexLocal(cert.classicalPub), fromHexLocal(cert.pqPublic)]);
+      const spendVerifiesAsCommit = ml_dsa65.verify(fromHexLocal(spendSig), asCommitMsg, fromHexLocal(cert.pqPublic));
+      return spendVerifiesAsCommit === false;
+    },
+    note: "Round 14 (this audit, same sweep as R13): test/vectors.mjs already checked that " +
+          "canonical() is DETERMINISTIC (same input twice -> same bytes) but nothing had ever " +
+          "attempted the actual cross-domain replay this encoding exists to stop. The mutation " +
+          "that should kill this is collapsing SPEND_DOMAIN to equal COMMIT_DOMAIN — it flips " +
+          "the `proof` above directly, which is the honest way to test a tag-collision defence: " +
+          "isolate the tag, not the field content, or a mutation could pass by accident for a " +
+          "reason that has nothing to do with domain separation (round 5's lesson again).",
+  },
+  {
+    id: "R15-log-and-registry-compose-without-losing-either-guarantee",
+    module: "custodian-log.mjs + policy-key-registry.mjs",
+    statement: "custodian-log.mjs and policy-key-registry.mjs were each tested wrapping " +
+               "authorizeAndSign directly, in complete isolation from each other. Composed " +
+               "with the log OUTERMOST and the registry INNERMOST — custodianAuthorize(log, " +
+               "key, req, ts, (r) => registry.authorize(r)) — a custodian gets BOTH " +
+               "guarantees at once: idempotency still holds, AND a refused cross-holder " +
+               "attempt still produces a hash-chained audit entry, rather than vanishing " +
+               "silently the way a registry-outermost composition would leave it.",
+    proof: () => {
+      const log = C.createAuditLog();
+      const registry = PKR.createPolicyKeyRegistry();
+      const authorizeFn = (r) => registry.authorize(r);
+      const r1 = C.custodianAuthorize(log, "r15-proof", goodReq(), 1, authorizeFn);
+      const r2 = C.custodianAuthorize(log, "r15-proof", goodReq(), 2, authorizeFn);
+      if (r1.authorized !== true || r2.idempotentReplay !== true) return false;
+      if (r1.policySignatureHex !== r2.policySignatureHex) return false;
+      if (log.entries.length !== 1) return false;
+      return log.verify().valid === true;
+    },
+    attack: () => {
+      // A genuinely SECOND holder — built the same way R13's attack builds one: its own
+      // fresh identity, fresh log, first-seen there, so this dies on nothing but the
+      // property being tested.
+      const otherIdent = generateMigrationIdentity();
+      const otherCert = createMigrationCommitment(otherIdent);
+      const otherEntries = [{ classicalPub: otherCert.classicalPub, pqPublic: otherCert.pqPublic,
+        classicalSig: otherCert.classicalSig, pqSig: otherCert.pqSig }];
+      const otherLeaves = otherEntries.map(P.entryLeaf);
+      const kp2 = ml_dsa65.keygen(new Uint8Array(32).fill(0x5a));
+      const otherSth = T.signTreeHead({ secretKey: kp2.secretKey, publicKey: kp2.publicKey,
+        treeSize: otherEntries.length, rootHash: T.merkleRoot(otherLeaves), timestampMs: 1_756_000_000_003 });
+      const otherHeadBytes = T.sthSignedBytes({ version: otherSth.version, logId: otherSth.logId,
+        treeSize: otherSth.treeSize, rootHash: T.fromHex(otherSth.rootHash), timestampMs: otherSth.timestampMs });
+      const otherOtsDigest = OTS.otsSha256(otherHeadBytes);
+      const otherOtsHex = T.toHex(OTS.encodeOtsFile({ majorVersion: OTS.OTS_MAJOR_VERSION, fileHashOp: "sha256",
+        fileDigest: otherOtsDigest, timestamp: OTS.timestampWithAttestation(otherOtsDigest, { kind: "bitcoin", height: 800_000 }) }));
+      const otherRoot = (() => { const a = OTS.evaluateOts(OTS.decodeOtsFile(T.fromHex(otherOtsHex))).blockAttestations[0];
+        return a.merkleRootInternalHex.match(/../g).reverse().join(""); })();
+      const otherHeaders = { 800_000: otherRoot };
+      const otherFactHash = certIsFirstSeen({ cert: otherCert, entries: otherEntries, sth: otherSth,
+        expectedLogId: otherSth.logId, cutoffBlockHeight: 900_000, otsHex: otherOtsHex,
+        blockMerkleRoots: otherHeaders, requireTemporalFrontier: true }).anchoredFactHash;
+      if (!otherFactHash) return false;
+      const otherSc = buildSpendContext({ anchoredFactHash: otherFactHash,
+        policyPublicKey: schnorr.getPublicKey(POLICY_KEY), txid: "44".repeat(32), valueSats: 70_000n,
+        outputs: [{ valueSats: 60_000n, scriptPubKey: new Uint8Array(34) }] });
+      const otherSig = authorizeSpend(otherIdent, otherSc.digest);
+      const otherReq = { cert: otherCert, pqSignatureHex: otherSig,
+        anchorEvidence: { sth: otherSth, entries: otherEntries, otsHex: otherOtsHex },
+        expectedLogId: otherSth.logId, policyKey: POLICY_KEY, cutoffBlockHeight: 900_000,
+        blockMerkleRoots: otherHeaders, spendContext: otherSc.spendContext };
+
+      const log = C.createAuditLog();
+      const registry = PKR.createPolicyKeyRegistry();
+      const authorizeFn = (r) => registry.authorize(r);
+      const r1 = C.custodianAuthorize(log, "r15-attack-a", goodReq(), 1, authorizeFn);
+      if (r1.authorized !== true) return false;
+      const r2 = C.custodianAuthorize(log, "r15-attack-b", otherReq, 2, authorizeFn);
+      // THE PROPERTY: refused, AND logged. A registry-outermost composition would satisfy
+      // "refused" while failing "logged" — both must hold for this claim to mean anything.
+      const refused = r2.authorized === false && r2.reason === "policy-key-bound-to-different-holder";
+      const logged = log.entries.length === 2 && log.entries[1].result.authorized === false &&
+        log.entries[1].result.reason === "policy-key-bound-to-different-holder";
+      return refused && logged && log.verify().valid === true;
+    },
+    note: "Round 15 (this audit, same sweep as R13/R14): the two stateful wrappers this " +
+          "package ships were each proven correct alone, and nothing had ever proven they " +
+          "compose. Building the composed test first (test/composed-custody.mjs) is what " +
+          "found the ordering hazard — registry-outermost silently drops the audit trail for " +
+          "exactly the attempts most worth recording. Fixed by giving custodianAuthorize an " +
+          "injectable `authorizeFn` (defaults to authorizeAndSign, so every existing R12 " +
+          "call site is unaffected) and documenting log-outer/registry-inner as the " +
+          "recommended composition, in the code itself, not only here.",
+  },
+  {
+    id: "R16-control-block-size-bounded-to-consensus-max",
+    module: "tapscript.mjs",
+    statement: "verifyControlBlock's own doc comment calls it 'the check consensus performs, " +
+               "done locally' — but until this round it had no upper bound on control-block " +
+               "size at all, so a Merkle path deeper than Bitcoin consensus allows (128 " +
+               "levels, 4129 bytes total) was reported valid:true by this library while a " +
+               "real Bitcoin node would reject it outright " +
+               "(SCRIPT_ERR_TAPROOT_WRONG_CONTROL_SIZE) before ever checking the path.",
+    proof: () => {
+      // Boundary correctness, not just presence of A bound: exactly AT the consensus max
+      // must still verify — a fix that is merely conservative (rejects too much) would
+      // itself be a divergence from consensus in the other direction.
+      const script = TS.checksigScript(new Uint8Array(32).fill(7));
+      let h = TS.tapLeafHash(script);
+      const path = [];
+      for (let i = 0; i < 128; i++) {
+        const sib = new Uint8Array(32).fill((i % 250) + 1);
+        path.push(sib);
+        h = TS.tapBranchHash(h, sib);
+      }
+      const { outputKey, parity } = TS.taprootOutputKeyWithTree(TS.NUMS_INTERNAL_KEY, h);
+      const cb = TS.controlBlock({ internalXOnly: TS.NUMS_INTERNAL_KEY, parity, path });
+      if (cb.length !== TS.TAPROOT_CONTROL_MAX_SIZE) return false; // setup check
+      return TS.verifyControlBlock(cb, script, outputKey).valid === true;
+    },
+    attack: () => {
+      // ONE level past the consensus max (129, not a round number chosen to look dramatic) —
+      // real TapLeaf/TapBranch hashing throughout, the exact construction a script-path
+      // spend with an oversized tree would actually produce.
+      const script = TS.checksigScript(new Uint8Array(32).fill(7));
+      let h = TS.tapLeafHash(script);
+      const path = [];
+      for (let i = 0; i < 129; i++) {
+        const sib = new Uint8Array(32).fill((i % 250) + 1);
+        path.push(sib);
+        h = TS.tapBranchHash(h, sib);
+      }
+      const { outputKey, parity } = TS.taprootOutputKeyWithTree(TS.NUMS_INTERNAL_KEY, h);
+      const cb = TS.controlBlock({ internalXOnly: TS.NUMS_INTERNAL_KEY, parity, path });
+      if (cb.length <= TS.TAPROOT_CONTROL_MAX_SIZE) return false; // setup check: must actually exceed it
+      const r = TS.verifyControlBlock(cb, script, outputKey);
+      return r.valid === false && r.reason === "malformed-control-block";
+    },
+    note: "Round 16 (this audit, adversarial sweep across the less-recently-touched files, " +
+          "run by an independent subagent whose finding was reproduced by hand before " +
+          "acting on it — round 5's lesson applied to trusting my OWN tooling, not just my " +
+          "own attacks). ots.mjs already bounded proof depth this same way (MAX_TREE_DEPTH); " +
+          "tapscript.mjs had no equivalent, and its own doc comment claiming to do 'the check " +
+          "consensus performs' made the omission a real, checkable overclaim, not a vague gap.",
+  },
+  {
+    id: "R17-sighash-rejects-malformed-txid",
+    module: "tx.mjs",
+    statement: "commonSighashParts (the function this file's own comment calls 'THE FUNCTION " +
+               "THAT ENDS THE SIGNING ORACLE') rejects a malformed txid instead of silently " +
+               "decoding it with Node's lenient Buffer.from(str,'hex') — which stops at the " +
+               "first invalid character instead of throwing. Before this round, two " +
+               "DECLARED-DIFFERENT malformed txids that shared a valid hex prefix could " +
+               "decode to the SAME bytes and produce the SAME sighash: the exact binding " +
+               "'which coin is this for' this function exists to make arithmetic rather than " +
+               "trusted, silently broken by an input serializeInputs would have refused.",
+    proof: () => {
+      // A well-formed request still signs correctly — the fix must not be merely
+      // conservative (rejecting valid input would be its own regression).
+      const spk = p2trScriptPubKey(new Uint8Array(32).fill(1));
+      const tx = { version: 2, locktime: 0, inputs: [{ txid: "11".repeat(32), vout: 0 }],
+        outputs: [{ valueSats: 1000n, scriptPubKey: spk }] };
+      const sh = taprootKeyPathSighash(tx, 0, [10_000n], [spk]);
+      return sh instanceof Uint8Array && sh.length === 32;
+    },
+    attack: () => {
+      // THE EXACT COLLISION the audit reproduced: two txids that are DIFFERENT strings,
+      // sharing only a valid hex prefix, must no longer silently collapse to one sighash —
+      // they must both be refused outright before any hashing happens.
+      const spk = p2trScriptPubKey(new Uint8Array(32).fill(1));
+      const txA = { version: 2, locktime: 0, inputs: [{ txid: "ab", vout: 0 }],
+        outputs: [{ valueSats: 1000n, scriptPubKey: spk }] };
+      const txB = { version: 2, locktime: 0,
+        inputs: [{ txid: "abzzzzzzzzzzzzzz-not-a-real-txid-at-all", vout: 0 }],
+        outputs: [{ valueSats: 1000n, scriptPubKey: spk }] };
+      const aThrew = threw(() => taprootKeyPathSighash(txA, 0, [10_000n], [spk]));
+      const bThrew = threw(() => taprootKeyPathSighash(txB, 0, [10_000n], [spk]));
+      return aThrew && bThrew;
+    },
+    note: "Round 17 (this audit, independent subagent finding, reproduced by hand before " +
+          "acting on it): serializeInputs already validated txid shape; commonSighashParts " +
+          "— used by BOTH the key-path and script-path signing flows, and the one " +
+          "policy.mjs's buildSpendContext calls on caller-supplied txid values before a " +
+          "holder ever signs — did not. The two code paths disagreed about what counts as a " +
+          "valid txid; now they agree.",
+  },
+  {
+    id: "R18-fee-rate-and-fee-amount-are-bounded",
+    module: "fees.mjs + broadcast.mjs",
+    statement: "selectCoins() refuses a fee rate above a documented sanity ceiling " +
+               "(MAX_FEE_RATE_SAT_PER_VB), and independently refuses to build a transaction " +
+               "whose fee would exceed the amount actually being sent — before this round, " +
+               "neither was bounded anywhere in the call chain from a fetched fee rate to a " +
+               "signed, broadcastable transaction.",
+    proof: () => {
+      // A normal, sane request is unaffected by either new bound.
+      const utxos = [{ txid: "11".repeat(32), vout: 0, valueSats: 100_000_000 }];
+      const r = selectCoins(utxos, 10_000, 5);
+      return r.hasChange === true && r.fee > 0 && r.fee < 10_000;
+    },
+    attack: () => {
+      // TWO SEPARATELY ISOLATED scenarios — round 5's lesson, applied to my own claim while
+      // writing it: the first draft of this attack used a fee rate so extreme (500,000
+      // sat/vB) that the fee-vs-target guard ALSO fired, so removing the rate ceiling alone
+      // left the mutation matrix unable to kill this claim through that path — the attack
+      // "held" for the wrong reason. Each scenario below trips exactly one guard.
+      const utxos = [{ txid: "22".repeat(32), vout: 0, valueSats: 100_000_000 }];
+      // Scenario A: rate is above the ceiling (10,000), but the resulting fee (~154 vB *
+      // 15,000 ≈ 2.3M sats) stays comfortably BELOW this target (3,000,000) — only the rate
+      // ceiling can catch this one.
+      const rateCeilingHeld = threw(() => selectCoins(utxos, 3_000_000, MAX_FEE_RATE_SAT_PER_VB + 5_000));
+      // Scenario B: rate (50) is far below the ceiling, but the resulting fee (~154 vB * 50
+      // ≈ 7,700 sats) exceeds this tiny target (100) — only the fee-vs-target guard can
+      // catch this one. THE EXACT SHAPE THE AUDIT REPRODUCED, scaled down: a rate that is
+      // individually plausible still wrecking a small payment.
+      const feeVsTargetHeld = threw(() => selectCoins(utxos, 100, 50));
+      return rateCeilingHeld && feeVsTargetHeld;
+    },
+    note: "Round 18 (this audit, independent subagent finding — broadcast.mjs/fees.mjs had " +
+          "zero registered claims or UNCLAIMED_GUARDS entries before this round, so this is " +
+          "new coverage for a real, previously-invisible fund-loss risk, not a re-report). " +
+          "Two independent bounds, not one: the rate ceiling alone does not protect a small " +
+          "payment against a rate that is individually plausible but still disproportionate, " +
+          "so selectCoins also refuses outright when the computed fee would exceed the " +
+          "amount being sent — no legitimate payment intentionally costs more in fees than " +
+          "it sends. fetchFeeRate() in broadcast.mjs enforces the same rate ceiling " +
+          "independently, for callers who use it directly rather than through selectCoins.",
+  },
   {
     id: "R11-finalized-witness-independently-verifies",
     module: "m2-broadcast.mjs",
@@ -839,8 +1168,12 @@ export const UNCLAIMED_GUARDS = Object.freeze([
   { where: "ots.mjs", guard: "the full OpenTimestamps opcode/branch semantics",
     why: "covered by the reference-implementation vector (block 358391) and by MAX_* bounds, " +
          "but no claim names the per-opcode behaviour" },
-  { where: "migration-envelope.mjs", guard: "verifySpend's own domain separation (SPEND vs COMMIT)",
-    why: "tested in test/vectors.mjs but not registered as a published sentence" },
+  // REMOVED (post-round-14): "verifySpend's own domain separation (SPEND vs COMMIT)" used to
+  // live here, described as "tested... but not registered as a published sentence" — which
+  // undersold the gap: test/vectors.mjs checked encoding DETERMINISM only, never the actual
+  // cross-domain replay. R14-commit-and-spend-domains-do-not-collide closes it with a real
+  // attack (replaying a genuine COMMIT signature as a SPEND authorisation, and back) and a
+  // mutation that collapses the two domain tags.
   { where: "transparency.mjs", guard: "RFC 6962 inclusion/consistency arithmetic itself",
     why: "covered by 33 CC0 conformance vectors, which is a stronger artefact than a claim, " +
          "but the vectors are not wired into the ledger" },
@@ -889,27 +1222,32 @@ export const UNCLAIMED_GUARDS = Object.freeze([
          "which key is valid NOW, multisig asks how many keys must agree — and a design that " +
          "supports both together (replace one of N signers without invalidating the others) " +
          "does not exist yet in prose or code." },
-  { where: "policy.mjs (nothing downstream of it exists yet)", guard: "finalize + broadcast for a script-path (M2) spend",
-    why: "NOT IMPLEMENTED. authorizeAndSign returns a raw Schnorr signature over a digest it " +
-         "computed; nothing in this package assembles that signature, the policy leaf, and the " +
-         "control block into a witness, serializes the transaction, or hands it to " +
-         "broadcast.mjs. scriptPathWitness() (tapscript.mjs) is called exactly once in the " +
-         "whole repo, in one test, only to check its shape — its output never reaches a " +
-         "serializer. A custodian cannot attempt a real M2 spend, even in dry-run, until this " +
-         "exists; it is the first thing anyone integrating M2 needs." },
-  { where: "policy.mjs", guard: "policyKey custody, and singlePolicyKeyPerHolder is not enforced",
+  // REMOVED (post-round-11): "finalize + broadcast for a script-path (M2) spend — NOT
+  // IMPLEMENTED" used to live here. Round 11 closed it: m2-broadcast.mjs rebuilds the exact
+  // witness a decision authorised (never a caller-supplied one), serializes the transaction,
+  // and hands it to broadcast.mjs — proven end to end by
+  // R11-finalized-witness-independently-verifies (a hand-rolled TapLeaf+TapTweak
+  // recomputation sharing no code with the module under test). Leaving this entry claiming
+  // "not implemented" after the gap closed would itself be exactly the prose-vs-code drift
+  // this file exists to catch — found stale during the 2026-09-04 gap sweep.
+  // NARROWED (post-round-13): "policyKey custody, and singlePolicyKeyPerHolder is not
+  // enforced" used to describe TWO distinct gaps as one. Round 13 closed the second:
+  // policy-key-registry.mjs is external, stateful enforcement that a policy key stays bound
+  // to the classical key that first claimed it — proven by
+  // R13-policy-key-registry-refuses-cross-holder-reuse, a genuine two-holder attack (not one
+  // that dies on an unrelated guard). What remains open, listed honestly rather than folded
+  // into a "done" entry:
+  { where: "policy.mjs / policy-key-registry.mjs", guard: "policyKey custody (the raw secret itself)",
     why: "The Taproot internal key is the unspendable NUMS point, so policyPub in the leaf " +
          "script is the ONLY spending path — and it is the SAME Schnorr key for every holder " +
-         "under one custodian. Losing or leaking it freezes or drains everyone that custodian " +
-         "serves, not just one holder; the letter's Tranche 2 discusses only holder-side key " +
-         "loss. Separately, every call site passes singlePolicyKeyPerHolder: true, but " +
-         "authorizeAndSign never reads that field — verified live, calling it with or without " +
-         "the field produces byte-identical behaviour. The 'concentration, not elimination' " +
-         "security story this whole package tells depends on one policy key mapping to " +
-         "exactly one holder, and today that is pure operator convention outside the library, " +
-         "with no detection if it's violated. The receipt used to echo a fake acknowledgement " +
-         "of the caller's assertion (`singlePolicyKeyPerHolderAsserted: true`) on a code path " +
-         "that turned out to be dead (spendContext has been mandatory since round 8, so the " +
-         "branch that built that field could never run) — removed rather than left as prose " +
-         "describing a possibility the code cannot reach. See POLICY_SCOPE.policyKeyCustody." },
+         "under one custodian. Losing or leaking the raw secret freezes or drains everyone " +
+         "that custodian serves, not just one holder. HSM or multisig custody of that secret " +
+         "is Tranche 2 paid engineering (the letter says so) and is NOT what Round 13 built." },
+  { where: "policy-key-registry.mjs", guard: "the wrapper is opt-in, not enforced by policy.mjs",
+    why: "A caller can still call authorizeAndSign directly, skip the registry entirely, and " +
+         "get the old, unenforced behaviour — nothing in policy.mjs requires going through " +
+         "the wrapper. That is a deliberate architectural choice (the decision engine stays " +
+         "stateless and network/storage-free; see the R12/R13 notes), but it means 'one " +
+         "policy key per holder' is only as real as the custodian's integration choosing to " +
+         "call createPolicyKeyRegistry().authorize() instead of authorizeAndSign() directly." },
 ]);