fractal-pqc 0.5.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",

package/src/claims-registry.mjs

@@ -181,10 +181,11 @@ export const CLAIMS = [
   {
     id: "R6-exposure-relative-primacy",
     module: "primacy.mjs",
-    statement: "A commitment anchored in Bitcoin strictly BEFORE the block that first " +
-               "exposed the holder's public key needs no Q-day estimate: at that moment " +
-               "there was no public key to break. Anchored after exposure, the strong " +
-               "claim is refused rather than softened.",
+    statement: "A commitment anchored in Bitcoin strictly BEFORE the block in which the " +
+               "CHAIN first revealed the holder's public key needs no Q-day estimate: at " +
+               "that moment breaking secp256k1 was not sufficient to produce it. Anchored " +
+               "after exposure — or with the exposure height merely ABSENT — the strong " +
+               "claim is refused, and the refusal says so in `valid`, not only in a new field.",
     proof: () => {
       const r = P.proveExposureRelativePrimacy({
         subjectClassicalPub: cert.classicalPub, entries: ENTRIES, sth: STH,
@@ -201,6 +202,16 @@ export const CLAIMS = [
       // coins should be moved rather than quietly degrading to the guessed cutoff.
       const late = P.proveExposureRelativePrimacy({ ...base, exposureHeight: ANCHOR_HEIGHT - 1 });
       if (late.exposureRelative !== false || late.reason !== "anchored-after-exposure") return false;
+      // ROUND 6: the refusal must be visible to a consumer that checks `.valid` — which is
+      // what every other gate in this package does. It used to come back green.
+      if (late.valid !== false || late.quantumPropertyHolds !== false) return false;
+      // ROUND 6: an ABSENT field is nobody's assertion. It used to yield "never-exposed",
+      // the strongest claim the module makes.
+      const omitted = P.proveExposureRelativePrimacy(base);
+      if (omitted.exposureRelative !== false || omitted.reason !== "exposure-height-not-supplied") return false;
+      // ROUND 6: the internal sentinel must never be accepted as a real exposure height.
+      if (P.proveExposureRelativePrimacy({ ...base, exposureHeight: Number.MAX_SAFE_INTEGER })
+            .exposureRelative !== false) return false;
       // Exposed at EXACTLY the anchor height is not "before" — the boundary must be strict.
       const same = P.proveExposureRelativePrimacy({ ...base, exposureHeight: ANCHOR_HEIGHT });
       if (same.exposureRelative !== false) return false;
@@ -466,6 +477,12 @@ export const UNCLAIMED_GUARDS = Object.freeze([
          "blocks) — again stronger than a claim, again not in the ledger" },
   { where: "policy.mjs", guard: "the ORDER of the refusal guards",
     why: "each guard is claimed individually; nothing claims that reordering them is safe" },
+  { where: "primacy.mjs", guard: "exposure-relative primacy is not an authorisation gate",
+    why: "policy.mjs does not consume it. It is a verifiable proof primitive; nothing in the " +
+         "signing path requires it, and we do not imply otherwise" },
+  { where: "primacy.mjs", guard: "'never exposed' is the CALLER's assertion",
+    why: "the kit cannot verify non-exposure. It can only refuse when the field is absent, " +
+         "which it now does. Off-chain publication of a key is outside what we measure" },
   { where: "primacy.mjs", guard: "key rotation / revocation",
     why: "NOT IMPLEMENTED. A holder who loses their ML-DSA secret is locked out permanently " +
          "and the old certificate keeps authorising. This is a known gap, not a covered one." },

package/src/index.mjs

@@ -56,7 +56,7 @@ export {
   parsePsbt, signPsbtTaprootKeyPath, finalizePsbt,
 } from "./psbt.mjs";
 
-export const VERSION = "0.5.0";
+export const VERSION = "0.5.1";
 
 // The security layer, actually exported. Round 2 of our own siege found that primacy,
 // policy and transparency existed in the repo and were unreachable from the published

package/src/mutations.mjs

@@ -109,6 +109,26 @@ export const MUTATIONS = [
     to: `    if (false) {`,
     mustKill: ["R6-exposure-relative-primacy"],
   },
+  {
+    id: "M-R6-absent-height-is-assertion",
+    describes: "R6: an ABSENT exposure height is treated as the 'never exposed' assertion again",
+    file: "src/primacy.mjs",
+    from: `  if (!args || !Object.hasOwn(args, "exposureHeight")) {`,
+    to: `  if (false) {`,
+    mustKill: ["R6-exposure-relative-primacy"],
+  },
+  {
+    id: "M-R6-refusal-stays-green",
+    describes: "R6: a refused exposure result comes back valid:true, as it did before",
+    file: "src/primacy.mjs",
+    from: `      ...base, valid: false, quantumPropertyHolds: false,
+      exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
+      reason: "anchored-after-exposure",`,
+    to: `      ...base,
+      exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
+      reason: "anchored-after-exposure",`,
+    mustKill: ["R6-exposure-relative-primacy"],
+  },
   {
     id: "M-R4-cutoff-unvalidated",
     describes: "R4: a malformed cutoff is coerced again — `height > NaN` passes silently",

package/src/primacy.mjs

@@ -546,10 +546,27 @@ export const PRIMACY_SCOPE = Object.freeze({
  * checkable in Bitcoin itself. Pass `null` to assert the key has never been exposed —
  * which the verifier must also confirm themselves.
  */
-export function proveExposureRelativePrimacy({
-  subjectClassicalPub, entries, sth, expectedLogId,
-  exposureHeight, otsHex, blockMerkleRoots,
-}) {
+export function proveExposureRelativePrimacy(args) {
+  const {
+    subjectClassicalPub, entries, sth, expectedLogId,
+    exposureHeight, otsHex, blockMerkleRoots,
+  } = args || {};
+
+  // FAIL-OPEN BY OMISSION (round 6 of our own siege). The guard below used `== null`, so
+  // an ABSENT field, an `undefined`, or a typo produced `strength: "never-exposed"` — the
+  // strongest claim this module makes — byte-identical to the deliberate `null` the
+  // docstring documents as a verifier ASSERTION. Absence is nobody's assertion. Worse, the
+  // sibling function in this same file uses the identical sentinel with the OPPOSITE
+  // polarity: it refuses. Presence is now required, and the comparison is strict.
+  if (!args || !Object.hasOwn(args, "exposureHeight")) {
+    return {
+      valid: false, exposureRelative: false, quantumPropertyHolds: false,
+      reason: "exposure-height-not-supplied",
+      note: "Non-exposure is an ASSERTION the verifier makes from their own node. A field " +
+            "that is simply absent does not make it. Pass an explicit height, or an " +
+            "explicit null to assert the key has never appeared on chain.",
+    };
+  }
   // Establish the anchor first, WITHOUT letting the exposure height act as the cutoff.
   // Passing the exposure as `cutoffBlockHeight` would make the base check fire first and
   // report a generic "anchored-after-cutoff", losing the specific — and far more useful —
@@ -565,7 +582,10 @@ export function proveExposureRelativePrimacy({
 
   if (!base.quantumPropertyHolds) {
     return {
-      ...base, exposureRelative: false,
+      // A refusal must say NO in the field consumers read. This kept `valid: true` from
+      // the spread, so the case this function exists to reject came back green to every
+      // caller that checks `.valid` — which is what the rest of this package does.
+      ...base, valid: false, quantumPropertyHolds: false, exposureRelative: false,
       reason: "no-confirmed-anchor",
       note: "Without a header-confirmed Bitcoin anchor there is no height to compare " +
             "against the exposure, so the stronger claim cannot be made.",
@@ -573,8 +593,16 @@ export function proveExposureRelativePrimacy({
   }
 
   const anchoredAt = base.temporalFrontier.height;
+  // The permissive cutoff passed internally is a SENTINEL, not a verifier's choice. It
+  // must never travel in the result as `cutoffBlockHeight`, where a reader could cite it
+  // as an established frontier.
+  base.temporalFrontier = {
+    ...base.temporalFrontier,
+    cutoffBlockHeight: undefined,
+    cutoffNotApplied: "none — exposure-relative mode; the comparison is against the key's exposure block",
+  };
 
-  if (exposureHeight == null) {
+  if (exposureHeight === null) {
     return {
       ...base, exposureRelative: true, anchoredAtHeight: anchoredAt, exposureHeight: null,
       strength: "never-exposed",
@@ -585,13 +613,21 @@ export function proveExposureRelativePrimacy({
     };
   }
 
-  if (!Number.isSafeInteger(exposureHeight) || exposureHeight < 0) {
-    return { ...base, exposureRelative: false, reason: "malformed-exposure-height" };
+  // An implausible height is not a height. MAX_SAFE_INTEGER especially: it is the internal
+  // sentinel, and accepting it as a real exposure would make every anchor look early.
+  if (!Number.isSafeInteger(exposureHeight) || exposureHeight < 0 || exposureHeight > 10_000_000) {
+    return {
+      ...base, valid: false, quantumPropertyHolds: false, exposureRelative: false,
+      reason: "malformed-exposure-height",
+      note: "Expected a plausible Bitcoin block height (0..10,000,000). Refused rather than " +
+            "coerced.",
+    };
   }
 
   if (anchoredAt >= exposureHeight) {
     return {
-      ...base, exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
+      ...base, valid: false, quantumPropertyHolds: false,
+      exposureRelative: false, anchoredAtHeight: anchoredAt, exposureHeight,
       reason: "anchored-after-exposure",
       strength: "cutoff-only",
       note: `Anchored at block ${anchoredAt}, but the key was already public at block ` +
@@ -607,8 +643,8 @@ export function proveExposureRelativePrimacy({
     blocksBefore: exposureHeight - anchoredAt,
     note: `Anchored at block ${anchoredAt}, ${exposureHeight - anchoredAt} blocks BEFORE ` +
           `the key was first exposed at ${exposureHeight}. At the moment of anchoring the ` +
-          `public key was not public, so no adversary — quantum or otherwise — had anything ` +
-          `to break. This claim does not depend on any Q-day estimate.`,
+          `chain had NOT yet revealed the public key, so breaking secp256k1 was not sufficient ` +
+          `to produce this commitment. This claim does not depend on any Q-day estimate.`,
   };
 }
 
@@ -626,6 +662,16 @@ export const EXPOSURE_SCOPE = Object.freeze({
   cannotSave:
     "keys already exposed by an earlier spend. You cannot anchor into the past, and no " +
     "evidence scheme changes that — those coins must be moved.",
+  alsoRequires:
+    "that the holder published the key through NO OTHER CHANNEL. We measure on-chain " +
+    "appearance only. A key revealed in a mempool broadcast that never confirmed, in a " +
+    "shared xpub, or anywhere off-chain was derivable earlier than this proof suggests. " +
+    "The adversary's window opens at min(any publication of the key, on-chain exposure); " +
+    "this kit measures the second.",
+  notAnAuthorisationGate:
+    "policy.mjs does not consume this. It is an independently verifiable proof primitive, " +
+    "not yet a mandatory gate on the signing path. Saying otherwise would be the sixth " +
+    "incarnation of the mistake this package documents.",
   exposureHeightIsNotOurs:
     "the verifier supplies it from their own node. An exposure height we asserted would be " +
     "one more thing to trust us about, and the point is that it is independently checkable.",