fractal-pqc 0.4.0 → 0.5.1

package/README.md

@@ -31,7 +31,7 @@ without invalidating already-signed history. This kit is a concrete, honest firs
 > dual-signed commitment before the verifier's cutoff height cannot be rescued by any of
 > this. `test/primacy.mjs` asserts that out loud rather than leaving it to be discovered.
 
-Everything below is exercised by `npm test` with real keys — **281 checks pass**:
+Everything below is exercised by `npm test` with real keys — **293 checks pass**:
 
 - **secp256k1** commitment + spend authorization (`@noble/curves`).
 - **Taproot BIP-340 Schnorr** sign/verify, asserted against the **official BIP-340 test

package/bin/cli.mjs

@@ -424,7 +424,7 @@ Usage:
                                            code it names is broken. A claim no mutation can
                                            kill is vacuous, and is reported as such.
   fractal-pqc verify-vector                Check the official BIP-340 test vector
-  fractal-pqc selftest                     Run everything: 281 real checks, no mocks
+  fractal-pqc selftest                     Run everything: 293 real checks, no mocks
 
 Docs: integrations/pqc-migration-kit/README.md`);
     process.exit(cmd ? 1 : 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",

package/src/claims-registry.mjs

@@ -178,6 +178,52 @@ export const CLAIMS = [
     },
     note: "R5: the most consequential guard in the module, and nothing named it.",
   },
+  {
+    id: "R6-exposure-relative-primacy",
+    module: "primacy.mjs",
+    statement: "A commitment anchored in Bitcoin strictly BEFORE the block in which the " +
+               "CHAIN first revealed the holder's public key needs no Q-day estimate: at " +
+               "that moment breaking secp256k1 was not sufficient to produce it. Anchored " +
+               "after exposure — or with the exposure height merely ABSENT — the strong " +
+               "claim is refused, and the refusal says so in `valid`, not only in a new field.",
+    proof: () => {
+      const r = P.proveExposureRelativePrimacy({
+        subjectClassicalPub: cert.classicalPub, entries: ENTRIES, sth: STH,
+        expectedLogId: STH.logId, otsHex: OTS_HEX, blockMerkleRoots: HEADERS,
+        exposureHeight: ANCHOR_HEIGHT + 50_000,
+      });
+      return r.exposureRelative === true && r.strength === "anchored-before-exposure" &&
+             r.blocksBefore === 50_000;
+    },
+    attack: () => {
+      const base = { subjectClassicalPub: cert.classicalPub, entries: ENTRIES, sth: STH,
+        expectedLogId: STH.logId, otsHex: OTS_HEX, blockMerkleRoots: HEADERS };
+      // Exposed BEFORE the anchor: the strong claim must be refused, and it must say the
+      // coins should be moved rather than quietly degrading to the guessed cutoff.
+      const late = P.proveExposureRelativePrimacy({ ...base, exposureHeight: ANCHOR_HEIGHT - 1 });
+      if (late.exposureRelative !== false || late.reason !== "anchored-after-exposure") return false;
+      // ROUND 6: the refusal must be visible to a consumer that checks `.valid` — which is
+      // what every other gate in this package does. It used to come back green.
+      if (late.valid !== false || late.quantumPropertyHolds !== false) return false;
+      // ROUND 6: an ABSENT field is nobody's assertion. It used to yield "never-exposed",
+      // the strongest claim the module makes.
+      const omitted = P.proveExposureRelativePrimacy(base);
+      if (omitted.exposureRelative !== false || omitted.reason !== "exposure-height-not-supplied") return false;
+      // ROUND 6: the internal sentinel must never be accepted as a real exposure height.
+      if (P.proveExposureRelativePrimacy({ ...base, exposureHeight: Number.MAX_SAFE_INTEGER })
+            .exposureRelative !== false) return false;
+      // Exposed at EXACTLY the anchor height is not "before" — the boundary must be strict.
+      const same = P.proveExposureRelativePrimacy({ ...base, exposureHeight: ANCHOR_HEIGHT });
+      if (same.exposureRelative !== false) return false;
+      // A malformed height must refuse, never coerce.
+      if (P.proveExposureRelativePrimacy({ ...base, exposureHeight: NaN }).exposureRelative !== false) return false;
+      // And with no header-confirmed anchor there is no height to compare at all.
+      return P.proveExposureRelativePrimacy({ ...base, blockMerkleRoots: undefined,
+        exposureHeight: ANCHOR_HEIGHT + 50_000 }).exposureRelative === false;
+    },
+    note: "The founder's insight: what is at risk is the PAST. A global Q-day is a guess; " +
+          "a key's exposure block is a fact in Bitcoin.",
+  },
   {
     id: "R4-cutoff-never-coerced",
     module: "primacy.mjs",
@@ -431,6 +477,12 @@ export const UNCLAIMED_GUARDS = Object.freeze([
          "blocks) — again stronger than a claim, again not in the ledger" },
   { where: "policy.mjs", guard: "the ORDER of the refusal guards",
     why: "each guard is claimed individually; nothing claims that reordering them is safe" },
+  { where: "primacy.mjs", guard: "exposure-relative primacy is not an authorisation gate",
+    why: "policy.mjs does not consume it. It is a verifiable proof primitive; nothing in the " +
+         "signing path requires it, and we do not imply otherwise" },
+  { where: "primacy.mjs", guard: "'never exposed' is the CALLER's assertion",
+    why: "the kit cannot verify non-exposure. It can only refuse when the field is absent, " +
+         "which it now does. Off-chain publication of a key is outside what we measure" },
   { where: "primacy.mjs", guard: "key rotation / revocation",
     why: "NOT IMPLEMENTED. A holder who loses their ML-DSA secret is locked out permanently " +
          "and the old certificate keeps authorising. This is a known gap, not a covered one." },

package/src/index.mjs

@@ -56,7 +56,7 @@ export {
   parsePsbt, signPsbtTaprootKeyPath, finalizePsbt,
 } from "./psbt.mjs";
 
-export const VERSION = "0.4.0";
+export const VERSION = "0.5.1";
 
 // The security layer, actually exported. Round 2 of our own siege found that primacy,
 // policy and transparency existed in the repo and were unreachable from the published

package/src/mutations.mjs

@@ -101,6 +101,34 @@ export const MUTATIONS = [
     to: `  "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"`,
     mustKill: ["R3-nums-required-for-enforcement"],
   },
+  {
+    id: "M-R6-exposure-boundary-not-strict",
+    describes: "R6: anchoring AT or AFTER exposure is accepted as if it were before",
+    file: "src/primacy.mjs",
+    from: `  if (anchoredAt >= exposureHeight) {`,
+    to: `    if (false) {`,
+    mustKill: ["R6-exposure-relative-primacy"],
+  },
+  {
+    id: "M-R6-absent-height-is-assertion",
+    describes: "R6: an ABSENT exposure height is treated as the 'never exposed' assertion again",
+    file: "src/primacy.mjs",
+    from: `  if (!args || !Object.hasOwn(args, "exposureHeight")) {`,
+    to: `  if (false) {`,
+    mustKill: ["R6-exposure-relative-primacy"],
+  },
+  {
+    id: "M-R6-refusal-stays-green",
+    describes: "R6: a refused exposure result comes back valid:true, as it did before",
+    file: "src/primacy.mjs",
+    from: `      ...base, valid: false, quantumPropertyHolds: false,
+      exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
+      reason: "anchored-after-exposure",`,
+    to: `      ...base,
+      exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
+      reason: "anchored-after-exposure",`,
+    mustKill: ["R6-exposure-relative-primacy"],
+  },
   {
     id: "M-R4-cutoff-unvalidated",
     describes: "R4: a malformed cutoff is coerced again — `height > NaN` passes silently",

package/src/primacy.mjs

@@ -500,3 +500,179 @@ export const PRIMACY_SCOPE = Object.freeze({
     "a subject-indexed side tree with non-membership proofs, committed in the head, would " +
     "make the enumeration O(log n). It is not implemented and is not claimed.",
 });
+
+
+/* ── EXPOSURE-RELATIVE PRIMACY ──────────────────────────────────────────── */
+
+/**
+ * Prove a commitment was anchored BEFORE the holder's public key was ever exposed.
+ *
+ * WHY THIS IS STRICTLY STRONGER THAN A Q-DAY CUTOFF
+ * -------------------------------------------------
+ * The cutoff frontier has an admitted weakness, and it is limit #2 in our README: the
+ * guarantee is "anchored before the cryptography broke", and NOBODY KNOWS WHEN IT BROKE.
+ * Every verifier is guessing a date, and a private break earlier than the guess produces
+ * forged entries indistinguishable from real ones.
+ *
+ * This removes the guess for a large and important class of holders.
+ *
+ * A secp256k1 public key has an exact, immutable, publicly verifiable moment at which it
+ * became known to the world: the block in which it first appeared on chain — the first
+ * spend from that address. Before that block the key existed only in its owner's wallet.
+ *
+ * So: if a commitment's tree head was anchored in Bitcoin STRICTLY BEFORE the block that
+ * first exposed the public key, then at the moment of anchoring NOBODY — with or without a
+ * quantum computer — could have derived the private key, because the PUBLIC key was not
+ * public yet. There was nothing to break.
+ *
+ * That is a per-key, chain-verifiable fact. It does not depend on anyone's estimate of
+ * Q-day, and it does not weaken if that estimate turns out to be wrong.
+ *
+ * WHO THIS ACTUALLY SAVES — AND WHO IT CANNOT
+ * -------------------------------------------
+ * In an UNSPENT P2PKH or P2WPKH output the chain holds only the HASH of the public key.
+ * The key itself is still private. Those holders can anchor today and obtain this stronger
+ * proof. That is the set of coins still worth protecting, and it is large.
+ *
+ * For a key already exposed by a previous spend, this gives NOTHING retroactively. You
+ * cannot anchor into the past. Those coins need to be moved, and no evidence scheme
+ * changes that. We say so rather than implying coverage we do not have.
+ *
+ * WHERE THE EXPOSURE HEIGHT COMES FROM — NOT FROM US
+ * --------------------------------------------------
+ * `exposureHeight` is supplied by the VERIFIER, derived from their own node or index. We
+ * deliberately do not ship an oracle for it: an exposure height we asserted would be one
+ * more thing to trust us about, and the entire point is that this fact is independently
+ * checkable in Bitcoin itself. Pass `null` to assert the key has never been exposed —
+ * which the verifier must also confirm themselves.
+ */
+export function proveExposureRelativePrimacy(args) {
+  const {
+    subjectClassicalPub, entries, sth, expectedLogId,
+    exposureHeight, otsHex, blockMerkleRoots,
+  } = args || {};
+
+  // FAIL-OPEN BY OMISSION (round 6 of our own siege). The guard below used `== null`, so
+  // an ABSENT field, an `undefined`, or a typo produced `strength: "never-exposed"` — the
+  // strongest claim this module makes — byte-identical to the deliberate `null` the
+  // docstring documents as a verifier ASSERTION. Absence is nobody's assertion. Worse, the
+  // sibling function in this same file uses the identical sentinel with the OPPOSITE
+  // polarity: it refuses. Presence is now required, and the comparison is strict.
+  if (!args || !Object.hasOwn(args, "exposureHeight")) {
+    return {
+      valid: false, exposureRelative: false, quantumPropertyHolds: false,
+      reason: "exposure-height-not-supplied",
+      note: "Non-exposure is an ASSERTION the verifier makes from their own node. A field " +
+            "that is simply absent does not make it. Pass an explicit height, or an " +
+            "explicit null to assert the key has never appeared on chain.",
+    };
+  }
+  // Establish the anchor first, WITHOUT letting the exposure height act as the cutoff.
+  // Passing the exposure as `cutoffBlockHeight` would make the base check fire first and
+  // report a generic "anchored-after-cutoff", losing the specific — and far more useful —
+  // distinction between "you anchored too late" and "you never anchored at all". The
+  // permissive cutoff here only obtains a header-CONFIRMED height; the real comparison is
+  // the one below, and it is the whole point of this function.
+  const base = proveFirstSeen({
+    subjectClassicalPub, entries, sth, expectedLogId,
+    cutoffBlockHeight: Number.MAX_SAFE_INTEGER,
+    otsHex, blockMerkleRoots,
+  });
+  if (!base.valid) return { ...base, exposureRelative: false };
+
+  if (!base.quantumPropertyHolds) {
+    return {
+      // A refusal must say NO in the field consumers read. This kept `valid: true` from
+      // the spread, so the case this function exists to reject came back green to every
+      // caller that checks `.valid` — which is what the rest of this package does.
+      ...base, valid: false, quantumPropertyHolds: false, exposureRelative: false,
+      reason: "no-confirmed-anchor",
+      note: "Without a header-confirmed Bitcoin anchor there is no height to compare " +
+            "against the exposure, so the stronger claim cannot be made.",
+    };
+  }
+
+  const anchoredAt = base.temporalFrontier.height;
+  // The permissive cutoff passed internally is a SENTINEL, not a verifier's choice. It
+  // must never travel in the result as `cutoffBlockHeight`, where a reader could cite it
+  // as an established frontier.
+  base.temporalFrontier = {
+    ...base.temporalFrontier,
+    cutoffBlockHeight: undefined,
+    cutoffNotApplied: "none — exposure-relative mode; the comparison is against the key's exposure block",
+  };
+
+  if (exposureHeight === null) {
+    return {
+      ...base, exposureRelative: true, anchoredAtHeight: anchoredAt, exposureHeight: null,
+      strength: "never-exposed",
+      note: `Anchored at block ${anchoredAt}, and you assert this key has NEVER appeared ` +
+            `on chain. If that holds, the key was never derivable by anyone at any point, ` +
+            `so no Q-day estimate is involved. Confirm the non-exposure yourself: this is ` +
+            `the one fact we cannot check for you.`,
+    };
+  }
+
+  // An implausible height is not a height. MAX_SAFE_INTEGER especially: it is the internal
+  // sentinel, and accepting it as a real exposure would make every anchor look early.
+  if (!Number.isSafeInteger(exposureHeight) || exposureHeight < 0 || exposureHeight > 10_000_000) {
+    return {
+      ...base, valid: false, quantumPropertyHolds: false, exposureRelative: false,
+      reason: "malformed-exposure-height",
+      note: "Expected a plausible Bitcoin block height (0..10,000,000). Refused rather than " +
+            "coerced.",
+    };
+  }
+
+  if (anchoredAt >= exposureHeight) {
+    return {
+      ...base, valid: false, quantumPropertyHolds: false,
+      exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
+      reason: "anchored-after-exposure",
+      strength: "cutoff-only",
+      note: `Anchored at block ${anchoredAt}, but the key was already public at block ` +
+            `${exposureHeight}. From that block on, anyone able to break secp256k1 could ` +
+            `have produced this commitment too. The proof falls back to whatever your ` +
+            `Q-day cutoff is worth — and that is a guess. These coins should be moved.`,
+    };
+  }
+
+  return {
+    ...base, exposureRelative: true, anchoredAtHeight: anchoredAt, exposureHeight,
+    strength: "anchored-before-exposure",
+    blocksBefore: exposureHeight - anchoredAt,
+    note: `Anchored at block ${anchoredAt}, ${exposureHeight - anchoredAt} blocks BEFORE ` +
+          `the key was first exposed at ${exposureHeight}. At the moment of anchoring the ` +
+          `chain had NOT yet revealed the public key, so breaking secp256k1 was not sufficient ` +
+          `to produce this commitment. This claim does not depend on any Q-day estimate.`,
+  };
+}
+
+export const EXPOSURE_SCOPE = Object.freeze({
+  proves:
+    "that a commitment was anchored in Bitcoin strictly before the block that first made " +
+    "the holder's public key public — a per-key fact, checkable in Bitcoin, that needs no " +
+    "Q-day estimate",
+  whyStronger:
+    "the cutoff frontier asks the verifier to guess when the cryptography broke. This asks " +
+    "nothing: before exposure there was no public key to break.",
+  savesWho:
+    "holders of UNSPENT P2PKH/P2WPKH outputs, where the chain holds only the key's hash. " +
+    "They can still anchor before exposing anything.",
+  cannotSave:
+    "keys already exposed by an earlier spend. You cannot anchor into the past, and no " +
+    "evidence scheme changes that — those coins must be moved.",
+  alsoRequires:
+    "that the holder published the key through NO OTHER CHANNEL. We measure on-chain " +
+    "appearance only. A key revealed in a mempool broadcast that never confirmed, in a " +
+    "shared xpub, or anywhere off-chain was derivable earlier than this proof suggests. " +
+    "The adversary's window opens at min(any publication of the key, on-chain exposure); " +
+    "this kit measures the second.",
+  notAnAuthorisationGate:
+    "policy.mjs does not consume this. It is an independently verifiable proof primitive, " +
+    "not yet a mandatory gate on the signing path. Saying otherwise would be the sixth " +
+    "incarnation of the mistake this package documents.",
+  exposureHeightIsNotOurs:
+    "the verifier supplies it from their own node. An exposure height we asserted would be " +
+    "one more thing to trust us about, and the point is that it is independently checkable.",
+});

package/test/claims.mjs

@@ -26,7 +26,7 @@ check("a proof that throws does not pass silently",
 check("HONESTY: the method states it does NOT prove completeness",
   CLAIMS_METHOD.whatItDoesNotProve.includes("completeness"));
 check("every claim names the siege round that taught us it needed guarding",
-  CLAIMS.every((c) => /^R[1-5]-/.test(c.id)));
+  CLAIMS.every((c) => /^R[1-6]-/.test(c.id)));
 
 /* ── the third admissibility condition ─────────────────────────────────── */
 import { MUTATIONS, MUTATION_METHOD } from "../src/mutations.mjs";
@@ -44,7 +44,7 @@ console.log("\nMutation coverage (cheap structural check; run `npm run mutate` f
   check("every mutation names a real claim",
     MUTATIONS.every((m) => m.mustKill.every((id) => CLAIMS.some((c) => c.id === id))));
   check("every mutation reintroduces a bug from a named siege round",
-    MUTATIONS.every((m) => /^M-R[1-5]-/.test(m.id) && typeof m.describes === "string"));
+    MUTATIONS.every((m) => /^M-R[1-6]-/.test(m.id) && typeof m.describes === "string"));
   check("HONESTY: the method states a surviving mutation can mean defence in depth, not a defect",
     MUTATION_METHOD.whatItDoesNotProve.includes("defence in depth"));
   check("HONESTY: and that it does not prove completeness either",

package/test/primacy.mjs

@@ -25,7 +25,7 @@ function check(name, cond) {
 }
 const te = new TextEncoder();
 const CUTOFF = 900_000;
-let OTS, HB, HDRS;                       // the verifier's declared Q-day boundary
+let OTS, HB, HDRS, STH_A;                       // the verifier's declared Q-day boundary
 
 console.log("PRIMACY — 'first' only counts if it means 'before the cryptography broke'\n");
 
@@ -179,7 +179,7 @@ console.log("\n★★★ ROUND 3 — what Bitcoin freezes is the PROOF OF CONTRO
       majorVersion: O.OTS_MAJOR_VERSION, fileHashOp: "sha256", fileDigest: digest, timestamp: ts,
     }));
   };
-  const otsHex = mkOts(800_000); OTS = otsHex; HB = headBytes;
+  const otsHex = mkOts(800_000); OTS = otsHex; HB = headBytes; STH_A = head.sth;
   const attRoot = (hex) => {
     const ev = O.evaluateOts(O.decodeOtsFile(T.fromHex(hex)));
     const a = ev.blockAttestations.find((x) => x.chain === "bitcoin");
@@ -331,5 +331,43 @@ console.log("\nRound-4 structural fixes:");
   })());
 }
 
+console.log("\n★★★ PRIMACÍA RELATIVA A LA EXPOSICIÓN — no depende de adivinar el Día-Q:");
+{
+  const { proveExposureRelativePrimacy, EXPOSURE_SCOPE } = await import("../src/primacy.mjs");
+  const common = { subjectClassicalPub: victimCert.classicalPub, entries, sth: STH_A,
+    expectedLogId: LOG_ID, otsHex: OTS, blockMerkleRoots: HDRS };
+
+  // El ancla real está en el bloque 800000 (ver el montaje de arriba).
+  const before = proveExposureRelativePrimacy({ ...common, exposureHeight: 850_000 });
+  check("★ anclado ANTES de la exposición → la afirmación fuerte se sostiene",
+    before.exposureRelative === true && before.strength === "anchored-before-exposure");
+  check("...y dice cuántos bloques de margen hay", before.blocksBefore === 50_000);
+  check("...y declara que NO depende de ninguna estimación de Día-Q",
+    before.note.includes("does not depend on any Q-day estimate"));
+
+  const after = proveExposureRelativePrimacy({ ...common, exposureHeight: 700_000 });
+  check("★ anclado DESPUÉS de la exposición → NO se hace la afirmación fuerte",
+    after.exposureRelative === false && after.reason === "anchored-after-exposure");
+  check("...y dice sin rodeos que esas monedas hay que moverlas",
+    after.note.includes("should be moved"));
+
+  const never = proveExposureRelativePrimacy({ ...common, exposureHeight: null });
+  check("clave nunca expuesta → la afirmación más fuerte posible",
+    never.exposureRelative === true && never.strength === "never-exposed");
+  check("HONESTIDAD: pide al verificador confirmar la no-exposición él mismo",
+    never.note.includes("we cannot check for you"));
+
+  check("una altura de exposición malformada se rehúsa, no se coerciona",
+    proveExposureRelativePrimacy({ ...common, exposureHeight: NaN }).exposureRelative === false);
+  check("sin ancla confirmada por cabecera no se hace ninguna afirmación fuerte",
+    proveExposureRelativePrimacy({ ...common, blockMerkleRoots: undefined, exposureHeight: 850_000 })
+      .exposureRelative === false);
+
+  check("HONESTIDAD: declara a quién NO puede salvar (claves ya expuestas)",
+    EXPOSURE_SCOPE.cannotSave.includes("must be moved"));
+  check("HONESTIDAD: la altura de exposición NO la ponemos nosotros",
+    EXPOSURE_SCOPE.exposureHeightIsNotOurs.includes("independently checkable"));
+}
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);