fractal-pqc 0.5.1 → 0.6.0

package/README.md

@@ -31,7 +31,7 @@ without invalidating already-signed history. This kit is a concrete, honest firs
 > dual-signed commitment before the verifier's cutoff height cannot be rescued by any of
 > this. `test/primacy.mjs` asserts that out loud rather than leaving it to be discovered.
 
-Everything below is exercised by `npm test` with real keys — **293 checks pass**:
+Everything below is exercised by `npm test` with real keys — **304 checks pass**:
 
 - **secp256k1** commitment + spend authorization (`@noble/curves`).
 - **Taproot BIP-340 Schnorr** sign/verify, asserted against the **official BIP-340 test

package/bin/cli.mjs

@@ -424,7 +424,7 @@ Usage:
                                            code it names is broken. A claim no mutation can
                                            kill is vacuous, and is reported as such.
   fractal-pqc verify-vector                Check the official BIP-340 test vector
-  fractal-pqc selftest                     Run everything: 293 real checks, no mocks
+  fractal-pqc selftest                     Run everything: 304 real checks, no mocks
 
 Docs: integrations/pqc-migration-kit/README.md`);
     process.exit(cmd ? 1 : 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",

package/src/claims-registry.mjs

@@ -224,6 +224,30 @@ export const CLAIMS = [
     note: "The founder's insight: what is at risk is the PAST. A global Q-day is a guess; " +
           "a key's exposure block is a fact in Bitcoin.",
   },
+  {
+    id: "R6-exposure-gate-enforced",
+    module: "policy.mjs",
+    statement: "If a caller supplies an exposure height, the engine ENFORCES it: a commitment " +
+               "anchored after the chain revealed the key is REFUSED and no signature is " +
+               "released. The parameter cannot be passed and silently ignored.",
+    proof: () => {
+      const r = authorizeAndSign({ ...goodReq(), exposureHeight: ANCHOR_HEIGHT + 50_000 });
+      return r.authorized === true && r.evidence.exposureRelative === true;
+    },
+    attack: () => {
+      // Anchored AFTER exposure: must refuse, and must release nothing.
+      const late = authorizeAndSign({ ...goodReq(), exposureHeight: ANCHOR_HEIGHT - 1 });
+      if (late.authorized !== false || late.policySignatureHex !== null) return false;
+      // A malformed height must not degrade to "ignored".
+      if (authorizeAndSign({ ...goodReq(), exposureHeight: NaN }).authorized !== false) return false;
+      // Present-but-undefined must not be treated as absent.
+      if (authorizeAndSign({ ...goodReq(), exposureHeight: undefined }).authorized !== false) return false;
+      // And omitting it entirely must still work — the gate is opt-in, not a break.
+      return authorizeAndSign(goodReq()).authorized === true;
+    },
+    note: "R6 left this as an explicit choice: wire it, or say it is not a gate. Doing " +
+          "neither would ship a stronger proof that nothing consumes.",
+  },
   {
     id: "R4-cutoff-never-coerced",
     module: "primacy.mjs",

package/src/index.mjs

@@ -56,7 +56,7 @@ export {
   parsePsbt, signPsbtTaprootKeyPath, finalizePsbt,
 } from "./psbt.mjs";
 
-export const VERSION = "0.5.1";
+export const VERSION = "0.6.0";
 
 // The security layer, actually exported. Round 2 of our own siege found that primacy,
 // policy and transparency existed in the repo and were unreachable from the published

package/src/mutations.mjs

@@ -129,6 +129,14 @@ export const MUTATIONS = [
       reason: "anchored-after-exposure",`,
     mustKill: ["R6-exposure-relative-primacy"],
   },
+  {
+    id: "M-R6-exposure-gate-ignored",
+    describes: "R6: the engine accepts an exposure height and ignores it",
+    file: "src/policy.mjs",
+    from: `    if (req && Object.hasOwn(req, "exposureHeight")) {`,
+    to: `    if (false) {`,
+    mustKill: ["R6-exposure-gate-enforced"],
+  },
   {
     id: "M-R4-cutoff-unvalidated",
     describes: "R4: a malformed cutoff is coerced again — `height > NaN` passes silently",

package/src/policy.mjs

@@ -47,7 +47,7 @@
 
 import { schnorr } from "@noble/curves/secp256k1.js";
 import { verifySpend } from "./migration-envelope.mjs";
-import { certIsFirstSeen } from "./primacy.mjs";
+import { certIsFirstSeen, proveExposureRelativePrimacy } from "./primacy.mjs";
 import { detectEquivocation } from "./transparency.mjs";
 
 const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
@@ -153,6 +153,36 @@ export function authorizeAndSign(req) {
       }
     }
 
+    // ── M2: EXPOSURE-RELATIVE PRIMACY, WIRED AS A GATE ─────────────────────
+    // Round 6 of our own siege left this as an explicit decision: either wire it into the
+    // signing path, or say in writing that it is a proof primitive and not a gate. Doing
+    // neither — shipping a stronger proof that nothing consumes — is how a package ends up
+    // claiming more than it enforces. This is the wiring.
+    //
+    // FAIL-CLOSED BY CONSTRUCTION: if the caller supplies `exposureHeight` at all, it is
+    // ENFORCED. There is no way to pass it and have it ignored, because a parameter that
+    // can be supplied and silently dropped is worse than one that does not exist.
+    if (req && Object.hasOwn(req, "exposureHeight")) {
+      const exp = proveExposureRelativePrimacy({
+        subjectClassicalPub: cert?.classicalPub,
+        entries: anchorEvidence.entries, sth: anchorEvidence.sth, expectedLogId,
+        exposureHeight: req.exposureHeight,
+        otsHex: anchorEvidence.otsHex, blockMerkleRoots: req.blockMerkleRoots,
+      });
+      if (!exp.exposureRelative) {
+        return refuse(REFUSED.ANCHOR_UNRESOLVED,
+          exp.reason === "anchored-after-exposure"
+            ? `The commitment was anchored at block ${exp.anchoredAtHeight}, but the chain had ` +
+              `already revealed this public key at block ${exp.exposureHeight}. From that block ` +
+              `on, anyone able to break secp256k1 could have produced this commitment too — so ` +
+              `it no longer distinguishes the holder from an attacker. These coins should be moved.`
+            : `Exposure-relative primacy could not be established (${exp.reason}).`,
+          { exposure: exp });
+      }
+      // Carry the stronger evidence forward so the caller can see WHY it was authorised.
+      req = { ...req, _exposureProof: exp };
+    }
+
     // PRIMACY, not membership. The anchor is the EARLIEST binding of this certificate's
     // own classical key in the pinned log — never a value lifted off the certificate.
     // The temporal frontier is REQUIRED here. After Q-day the attacker's commitment is as
@@ -198,6 +228,15 @@ export function authorizeAndSign(req) {
         ignoredUnsignedEntries: anchor.ignoredUnsignedEntries,
         temporalFrontier: anchor.temporalFrontier,
         quantumPropertyHolds: anchor.quantumPropertyHolds,
+        ...(req._exposureProof ? {
+          exposureRelative: true,
+          anchoredAtHeight: req._exposureProof.anchoredAtHeight,
+          exposureHeight: req._exposureProof.exposureHeight,
+          strength: req._exposureProof.strength,
+          whyThisIsStronger: "no Q-day estimate is involved: at the moment of anchoring the " +
+            "chain had not yet revealed this public key, so breaking secp256k1 was not " +
+            "sufficient to produce this commitment",
+        } : {}),
         digestSigned: toHex(digest),
         logId: anchor.logId,
         logPinned: true,
@@ -271,6 +310,12 @@ export const POLICY_SCOPE = Object.freeze({
     "detectEquivocation) and not preventable by this module. Pass `knownHeads` from a " +
     "witness, mirror or gossip channel and the engine refuses on any contradiction; without " +
     "them you are trusting the log to have shown you its only history.",
+  exposureRelativeGate:
+    "if `exposureHeight` is supplied it is ENFORCED, never advisory — a parameter that can " +
+    "be passed and silently dropped is worse than one that does not exist. When enforced, " +
+    "authorisation requires the commitment to have been anchored strictly before the chain " +
+    "first revealed the key, which needs no Q-day estimate. Omit it and the engine falls " +
+    "back to the cutoff frontier, which is a guess and says so.",
   precondition:
     "the true holder must have registered a dual-signed commitment BEFORE the cutoff. If " +
     "they never did, no one is authorised — not them, not an attacker. Those coins are " +

package/test/primacy.mjs

@@ -369,5 +369,41 @@ console.log("\n★★★ PRIMACÍA RELATIVA A LA EXPOSICIÓN — no depende de a
     EXPOSURE_SCOPE.exposureHeightIsNotOurs.includes("independently checkable"));
 }
 
+console.log("\n★★★ M2 CABLEADO — el gate de exposición en la ruta de firma:");
+{
+  const policyPriv4 = schnorr.utils.randomSecretKey();
+  const d4 = sha256(te.encode("spend-m2"));
+  const req4 = { cert: victimCert, spendDigest: d4, pqSignatureHex: authorizeSpend(victim, d4),
+    anchorEvidence: { sth: head.sth, entries, otsHex: OTS }, expectedLogId: LOG_ID,
+    policyKey: policyPriv4, cutoffBlockHeight: 900_000, blockMerkleRoots: HDRS };
+
+  // El ancla está en el bloque 800000 (montaje de arriba).
+  const ok = authorizeAndSign({ ...req4, exposureHeight: 850_000 });
+  check("★★ AUTORIZA cuando el compromiso es anterior a la exposición",
+    ok.authorized === true && ok.evidence.exposureRelative === true);
+  check("...y la evidencia dice POR QUÉ es más fuerte",
+    ok.evidence.whyThisIsStronger.includes("no Q-day estimate"));
+  check("...y libera una firma Schnorr verificable",
+    schnorr.verify(T.fromHex(ok.policySignatureHex), d4, schnorr.getPublicKey(policyPriv4)) === true);
+
+  const late = authorizeAndSign({ ...req4, exposureHeight: 700_000 });
+  check("★★ REHÚSA cuando la clave ya estaba expuesta al anclar",
+    late.authorized === false && late.policySignatureHex === null);
+  check("...y le dice al custodio que esas monedas hay que moverlas",
+    late.detail.includes("should be moved"));
+
+  check("★ el parámetro NO se puede pasar y que lo ignoren (fail-closed)",
+    authorizeAndSign({ ...req4, exposureHeight: NaN }).authorized === false);
+  check("★ un campo presente pero undefined tampoco se ignora",
+    authorizeAndSign({ ...req4, exposureHeight: undefined }).authorized === false);
+  check("omitirlo por completo → cae al cutoff, que es una estimación y lo dice",
+    authorizeAndSign(req4).authorized === true &&
+    authorizeAndSign(req4).evidence.exposureRelative === undefined);
+  check("nunca-expuesta (null explícito) autoriza con la fuerza máxima",
+    authorizeAndSign({ ...req4, exposureHeight: null }).authorized === true);
+  check("HONESTIDAD: el scope declara que si se suministra, se IMPONE",
+    POLICY_SCOPE.exposureRelativeGate.includes("ENFORCED, never advisory"));
+}
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);