fractal-pqc 0.6.0 → 0.7.0

package/README.md

@@ -19,7 +19,7 @@ without invalidating already-signed history. This kit is a concrete, honest firs
 
 ## What is REAL here (verified, not aspirational)
 
-> **The security layer (v0.4.0):** `transparency.mjs` (PQ-ANCHOR-v1 append-only log:
+> **The security layer (v0.7.0):** `transparency.mjs` (PQ-ANCHOR-v1 append-only log:
 > inclusion + consistency proofs, ML-DSA-65 signed heads, equivocation detection),
 > `primacy.mjs` (first-seen proven by complete enumeration + a Bitcoin-anchored temporal
 > frontier), `policy.mjs` (fail-closed custodian gate), `tapscript.mjs` (BIP-341
@@ -94,7 +94,7 @@ verifyMigrationCommitment(cert).valid;           // true
 
 ```bash
 npx fractal-pqc verify-vector          # assert the official BIP-340 test vector
-npx fractal-pqc selftest               # run the full real test suite (46 checks)
+npx fractal-pqc selftest               # run the full real test suite (304 checks)
 npx fractal-pqc keygen > key.json      # generate a migration identity (testnet/experimental)
 npx fractal-pqc keygen --taproot > tk.json           # a Taproot key
 npx fractal-pqc address --key tk.json --network tb   # derive a real tb1p… Taproot address
@@ -132,7 +132,18 @@ Providing the anchor registry (first-seen, no-duplicate, immutable) is part of t
 grant-funded roadmap below; this reference makes the anchor a **required verifier input**
 so the property is never silently over-claimed.
 
-## What this is NOT (honest scope — do not overstate)
+## What this is NOT
+
+> **ONE POLICY KEY PER HOLDER — OR BIND THE OUTPUT.** `authorizeAndSign` reads a 32-byte
+> `spendDigest` chosen by the requester. Round 7 of our own siege used that to have one
+> *legitimate* client of a custodian obtain a policy-key signature over **another client's
+> sighash** — which is exactly the "concentration" deployment this package describes. The
+> engine now **refuses any request that does not say which coin it is for**: supply
+> `spendContext.prevoutScriptPubKey` (enforced against the holder's own anchored commitment)
+> or explicitly assert `singlePolicyKeyPerHolder: true`. Silence is refused. Residual, stated
+> rather than hidden: the engine checks the scriptPubKey the commitment governs, it does not
+> recompute the BIP-341 sighash from the transaction.
+ (honest scope — do not overstate)
 
 - **Not yet confirmed in a live mempool.** The sighash is proven consensus-correct against
   the official BIP-341 vector, and the broadcaster is built + dry-run-tested — but an actual

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",

package/src/claims-registry.mjs

@@ -12,7 +12,8 @@ import * as T from "./transparency.mjs";
 import * as P from "./primacy.mjs";
 import * as TS from "./tapscript.mjs";
 import * as OTS from "./ots.mjs";
-import { POLICY_SCOPE, authorizeAndSign, REFUSED } from "./policy.mjs";
+import { POLICY_SCOPE, authorizeAndSign, REFUSED, policyOutputScriptPubKey } from "./policy.mjs";
+import { schnorr } from "@noble/curves/secp256k1.js";
 import { generateMigrationIdentity, createMigrationCommitment, authorizeSpend } from "./migration-envelope.mjs";
 
 const te = new TextEncoder();
@@ -68,6 +69,10 @@ const goodReq = () => ({
   anchorEvidence: { sth: STH, entries: ENTRIES, otsHex: OTS_HEX },
   expectedLogId: STH.logId, policyKey: POLICY_KEY,
   cutoffBlockHeight: CUTOFF, blockMerkleRoots: HEADERS,
+  // Round 7 made this explicit rather than defaulted: the engine refuses a request that
+  // does not say WHICH coin it is for. These fixtures are single-holder scenarios, so they
+  // assert the safe deployment instead of silently relying on it.
+  singlePolicyKeyPerHolder: true,
 });
 
 export const CLAIMS = [
@@ -224,6 +229,78 @@ export const CLAIMS = [
     note: "The founder's insight: what is at risk is the PAST. A global Q-day is a guess; " +
           "a key's exposure block is a fact in Bitcoin.",
   },
+  {
+    id: "R7-output-binding-or-refusal",
+    module: "policy.mjs",
+    statement: "The engine never signs without knowing WHICH coin it signs for. Either the " +
+               "caller binds the spend to an output (enforced against the holder's own " +
+               "anchored commitment) or the caller explicitly asserts one policy key per " +
+               "holder. Silence is refused, and one holder's certificate can never authorise " +
+               "a spend of another holder's output.",
+    proof: () => {
+      // Bound to the output this holder's commitment actually governs: authorises, and the
+      // receipt SAYS it is bound.
+      const anchoredFactHash = authorizeAndSign(goodReq()).evidence.anchoredFactHash;
+      const spk = policyOutputScriptPubKey(anchoredFactHash, schnorr.getPublicKey(POLICY_KEY));
+      const r = authorizeAndSign({ ...goodReq(), spendContext: { prevoutScriptPubKey: spk } });
+      return r.authorized === true && r.evidence.outputBound === true;
+    },
+    attack: () => {
+      // 1. Silence must NOT be the permissive default. This is the whole finding: round 7
+      //    had one legitimate client of a custodian buy a signature over another client's
+      //    sighash precisely because omitting the binding authorised anyway.
+      const { singlePolicyKeyPerHolder: _drop, ...silent } = goodReq();
+      const q = authorizeAndSign(silent);
+      if (q.authorized !== false || q.policySignatureHex !== null) return false;
+      // 2. A DIFFERENT holder's output must be refused, not signed.
+      const other = "11".repeat(32);
+      const foreign = policyOutputScriptPubKey(other, schnorr.getPublicKey(POLICY_KEY));
+      const r = authorizeAndSign({ ...goodReq(), spendContext: { prevoutScriptPubKey: foreign } });
+      if (r.authorized !== false || r.policySignatureHex !== null) return false;
+      // 3. A malformed binding must refuse rather than fall back to the unbound path.
+      const bad = authorizeAndSign({ ...goodReq(), spendContext: { prevoutScriptPubKey: "00" } });
+      if (bad.authorized !== false) return false;
+      // 4. The asserted single-key mode still works, and the receipt does not claim binding.
+      const a = authorizeAndSign(goodReq());
+      return a.authorized === true && a.evidence.outputBound === false;
+    },
+    note: "Round 7's critical. `spendDigest` is 32 opaque bytes chosen by the requester; " +
+          "before this, the receipt named the HOLDER while the coin could be anyone's. " +
+          "RESIDUAL, stated rather than hidden: the engine checks that the scriptPubKey is " +
+          "the one this commitment governs, but does not recompute the BIP-341 sighash from " +
+          "the transaction — the caller must derive the digest from the prevout it presents.",
+  },
+  {
+    id: "R7-no-claim-without-the-proof-that-earns-it",
+    module: "policy.mjs",
+    statement: "No evidence field this engine emits can be supplied by the caller. Exposure " +
+               "claims are DERIVED from a proof this engine ran, and evidence that can change " +
+               "between the check and the use is refused rather than read twice.",
+    proof: () => {
+      const r = authorizeAndSign({ ...goodReq(), exposureHeight: ANCHOR_HEIGHT + 50_000 });
+      return r.evidence.exposureRelative === true && r.evidence.anchoredAtHeight === ANCHOR_HEIGHT;
+    },
+    attack: () => {
+      // 1. Inject the conclusion: a fabricated internal field must never become a claim.
+      const inj = authorizeAndSign({ ...goodReq(),
+        _exposureProof: { exposureRelative: true, anchoredAtHeight: 1,
+                          exposureHeight: 9_999_999, strength: "anchored-before-exposure" } });
+      if (inj.authorized !== false) return false;
+      if (inj.evidence && inj.evidence.exposureRelative === true) return false;
+      // 2. Two-faced evidence: an accessor can return different bytes to the gate and to the
+      //    authorisation. It must be refused outright, not read twice.
+      const g = goodReq();
+      const twoFaced = { get sth() { return g.anchorEvidence.sth; },
+                         entries: g.anchorEvidence.entries, otsHex: g.anchorEvidence.otsHex };
+      const t = authorizeAndSign({ ...g, anchorEvidence: twoFaced });
+      return t.authorized === false && t.policySignatureHex === null;
+    },
+    note: "Round 7 found BOTH halves: `_exposureProof` travelled on the caller's object and " +
+          "`exposureRelative: true` was a hardcoded literal, so a plain JSON request produced " +
+          "this package's strongest claim with no proof behind it — even when the injected " +
+          "object said false. The TOCTOU discipline applied to spendDigest had not been " +
+          "applied to anchorEvidence one field further out.",
+  },
   {
     id: "R6-exposure-gate-enforced",
     module: "policy.mjs",
@@ -501,9 +578,18 @@ export const UNCLAIMED_GUARDS = Object.freeze([
          "blocks) — again stronger than a claim, again not in the ledger" },
   { where: "policy.mjs", guard: "the ORDER of the refusal guards",
     why: "each guard is claimed individually; nothing claims that reordering them is safe" },
-  { where: "primacy.mjs", guard: "exposure-relative primacy is not an authorisation gate",
-    why: "policy.mjs does not consume it. It is a verifiable proof primitive; nothing in the " +
-         "signing path requires it, and we do not imply otherwise" },
+  { where: "policy.mjs", guard: "WHICH OUTPUT is being spent — unless spendContext is supplied",
+    why: "the engine reads a 32-byte spendDigest chosen by the requester. WITHOUT " +
+         "`spendContext.prevoutScriptPubKey` the receipt identifies the HOLDER, never the " +
+         "COIN: it records who was authorised to make the policy key sign SOMETHING. Round 7 " +
+         "used exactly this to have one legitimate client of a custodian buy a signature over " +
+         "another client's sighash. Supply spendContext (enforced when present) or use ONE " +
+         "POLICY KEY PER HOLDER, without exception" },
+  { where: "policy.mjs / primacy.mjs", guard: "prose-to-code agreement",
+    why: "the ledger governs CODE -> CLAIM (kill the code and the claim dies). NOTHING " +
+         "governs PROSE -> CODE. Every one of round 7's findings landed in that hole, " +
+         "including a frozen *_SCOPE string that asserted the M2 gate did not exist while " +
+         "the gate was refusing signatures. This is the ledger's own known limit" },
   { where: "primacy.mjs", guard: "'never exposed' is the CALLER's assertion",
     why: "the kit cannot verify non-exposure. It can only refuse when the field is absent, " +
          "which it now does. Off-chain publication of a key is outside what we measure" },

package/src/mutations.mjs

@@ -238,6 +238,33 @@ export const MUTATIONS = [
     to: `    return { equivocation: false, reason: "heads-agree" };`,
     mustKill: ["R1-same-size-is-non-repudiable"],
   },
+  {
+    id: "M-R7-output-binding-optional",
+    describes: "R7: silence becomes the permissive default again — the engine signs without " +
+               "ever knowing which coin it is signing for",
+    file: "src/policy.mjs",
+    from: `    if (!req || (!Object.hasOwn(req, "spendContext") && req.singlePolicyKeyPerHolder !== true)) {`,
+    to: `    if (false) {`,
+    mustKill: ["R7-output-binding-or-refusal"],
+  },
+  {
+    id: "M-R7-injected-conclusion-accepted",
+    describes: "R7: internal fields travel on the caller's request again, so a fabricated " +
+               "_exposureProof states this package's strongest claim with no proof behind it",
+    file: "src/policy.mjs",
+    from: `      if (k.startsWith("_")) {`,
+    to: `      if (k.startsWith("\u0000NEVER")) {`,
+    mustKill: ["R7-no-claim-without-the-proof-that-earns-it"],
+  },
+  {
+    id: "M-R7-two-faced-evidence",
+    describes: "R7: accessor-backed anchorEvidence is read twice again — the gate judges one " +
+               "anchor and the authorisation rests on another",
+    file: "src/policy.mjs",
+    from: `      if (d && typeof d.get === "function") {`,
+    to: `      if (false) {`,
+    mustKill: ["R7-no-claim-without-the-proof-that-earns-it"],
+  },
 ];
 
 /**

package/src/policy.mjs

@@ -49,8 +49,46 @@ import { schnorr } from "@noble/curves/secp256k1.js";
 import { verifySpend } from "./migration-envelope.mjs";
 import { certIsFirstSeen, proveExposureRelativePrimacy } from "./primacy.mjs";
 import { detectEquivocation } from "./transparency.mjs";
+import { NUMS_INTERNAL_KEY, tapLeafHash, taprootOutputKeyWithTree } from "./tapscript.mjs";
 
 const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+const fromHexP = (h) => {
+  if (typeof h !== "string" || h.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(h)) return null;
+  const out = new Uint8Array(h.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(h.slice(i * 2, i * 2 + 2), 16);
+  return out;
+};
+
+/**
+ * THE CANONICAL POLICY LEAF — the thing that makes an authorisation about a COIN and not
+ * merely about a person.
+ *
+ *     <32-byte anchoredFactHash> OP_DROP <32-byte policy x-only key> OP_CHECKSIG
+ *
+ * The pushed fact hash is consensus-inert (OP_DROP discards it) but it is COMMITTED: it is
+ * inside the leaf, so it is inside the TapLeaf hash, so it is inside the Taproot output key,
+ * so it is inside the scriptPubKey the chain already holds. One holder's commitment therefore
+ * produces exactly one output key, and no other holder's does.
+ */
+export function policyLeafScript(anchoredFactHashHex, policyXOnly) {
+  const fh = fromHexP(anchoredFactHashHex);
+  if (!fh || fh.length !== 32) return null;
+  if (!(policyXOnly instanceof Uint8Array) || policyXOnly.length !== 32) return null;
+  const out = new Uint8Array(1 + 32 + 1 + 1 + 32 + 1);
+  out[0] = 0x20; out.set(fh, 1); out[33] = 0x75;            // push32 <factHash> OP_DROP
+  out[34] = 0x20; out.set(policyXOnly, 35); out[67] = 0xac; // push32 <policyPub> OP_CHECKSIG
+  return out;
+}
+
+/** The P2TR scriptPubKey a given holder's commitment must produce: OP_1 PUSH32 <outputKey>. */
+export function policyOutputScriptPubKey(anchoredFactHashHex, policyXOnly) {
+  const leaf = policyLeafScript(anchoredFactHashHex, policyXOnly);
+  if (!leaf) return null;
+  const { outputKey } = taprootOutputKeyWithTree(NUMS_INTERNAL_KEY, tapLeafHash(leaf));
+  const spk = new Uint8Array(34);
+  spk[0] = 0x51; spk[1] = 0x20; spk.set(outputKey, 2);
+  return spk;
+}
 
 export const REFUSED = Object.freeze({
   NO_ANCHOR_EVIDENCE: "no-anchor-evidence",
@@ -59,6 +97,8 @@ export const REFUSED = Object.freeze({
   PQ_INVALID: "pq-signature-invalid",
   NO_POLICY_KEY: "policy-key-unavailable",
   BAD_DIGEST: "spend-digest-malformed",
+  MALFORMED_REQUEST: "request-malformed",
+  OUTPUT_NOT_BOUND: "spend-not-bound-to-this-holder-output",
   ERROR: "internal-error-fail-closed",
 });
 
@@ -88,6 +128,22 @@ export function authorizeAndSign(req) {
       cert, spendDigest, pqSignatureHex, anchorEvidence, expectedLogId, policyKey,
     } = req || {};
 
+    // ROUND 7. `_exposureProof` used to be routed BACK through the caller's own object, so a
+    // plain JSON request carrying a fabricated `_exposureProof` made the engine emit this
+    // package's STRONGEST claim — exposure-relative primacy, invented heights, "no Q-day
+    // estimate is involved" — without the gate ever running, and even when the injected
+    // object said the opposite. That is round 6's defect (absent field buys the maximal
+    // claim) reappearing inside the file written to cure it. Internal state never travels
+    // on the request, and a request that carries any is refused rather than sanitised.
+    for (const k of Object.keys(req || {})) {
+      if (k.startsWith("_")) {
+        return refuse(REFUSED.MALFORMED_REQUEST,
+          `The request carries an internal field (${k}). Fields prefixed with "_" are produced ` +
+          `by this engine and never accepted from a caller: supplying one is an attempt to ` +
+          `state a conclusion instead of proving it.`);
+      }
+    }
+
     // TOCTOU: `instanceof` + `.length` are both satisfied by a Proxy that returns
     // different bytes on successive reads, so the ML-DSA check and the Schnorr signature
     // saw DIFFERENT digests — one authorised spend bought a signature over another.
@@ -109,6 +165,29 @@ export function authorizeAndSign(req) {
         "head and the complete ordered entry list. The anchor is the whole quantum property; " +
         "without it there is nothing to enforce.");
     }
+
+    // ROUND 7, THE SAME TOCTOU WE ALREADY FIXED ONCE — one field further out. `spendDigest`
+    // got `snapshot32` after an earlier siege; `anchorEvidence` did not, and it is read by
+    // the M2 gate, then again by certIsFirstSeen, then again by detectEquivocation. A single
+    // accessor split that seam: the exposure gate judged an EARLY anchor while authorisation
+    // was founded on a LATE one, and the receipt came out contradicting itself. Discipline is
+    // only discipline if it is applied to every caller-supplied input: refuse accessor-backed
+    // carriers, then snapshot ONCE and read nothing but the snapshot below.
+    for (const k of ["sth", "entries", "otsHex"]) {
+      const d = Object.getOwnPropertyDescriptor(anchorEvidence, k);
+      if (d && typeof d.get === "function") {
+        return refuse(REFUSED.NO_ANCHOR_EVIDENCE,
+          `anchorEvidence.${k} is accessor-backed, so it can return different bytes on ` +
+          `successive reads. Evidence that is allowed to change between the check and the ` +
+          `use is refused outright rather than read twice.`);
+      }
+    }
+    const ev = Object.freeze({
+      sth: anchorEvidence.sth,
+      entries: anchorEvidence.entries.slice(),
+      otsHex: anchorEvidence.otsHex,
+    });
+    const subjectPub = cert?.classicalPub;   // read ONCE; every consumer below uses this copy
     if (req && req.cutoffBlockHeight != null &&
         (typeof req.cutoffBlockHeight !== "number" || !Number.isSafeInteger(req.cutoffBlockHeight) ||
          req.cutoffBlockHeight < 0)) {
@@ -144,7 +223,7 @@ export function authorizeAndSign(req) {
     // contradiction instead of warning about it.
     if (Array.isArray(req.knownHeads) && req.knownHeads.length) {
       for (const other of req.knownHeads) {
-        const d = detectEquivocation(anchorEvidence.sth, other);
+        const d = detectEquivocation(ev.sth, other);
         if (d.equivocation === true) {
           return refuse(REFUSED.ANCHOR_UNRESOLVED,
             "This log signed two contradictory histories. Every proof it serves is void, " +
@@ -159,15 +238,23 @@ export function authorizeAndSign(req) {
     // neither — shipping a stronger proof that nothing consumes — is how a package ends up
     // claiming more than it enforces. This is the wiring.
     //
-    // FAIL-CLOSED BY CONSTRUCTION: if the caller supplies `exposureHeight` at all, it is
-    // ENFORCED. There is no way to pass it and have it ignored, because a parameter that
-    // can be supplied and silently dropped is worse than one that does not exist.
+    // FAIL-CLOSED WHEN SUPPLIED: if the caller supplies `exposureHeight` as an OWN data
+    // property, it is ENFORCED — it cannot be passed and silently dropped, because a
+    // parameter that can be is worse than one that does not exist. Two honest bounds, both
+    // found by round 7 and both stated here rather than only in prose: (1) "supplied" means
+    // an own property, so an inherited or Proxy-hidden one is treated as ABSENT and falls
+    // back to the cutoff frontier — it never yields a false exposure claim, but it is not
+    // enforced either; (2) this gate is a CONJUNCTION, never a substitution: cutoffBlockHeight
+    // stays mandatory above and certIsFirstSeen still applies it below. Supplying an exposure
+    // height NARROWS what authorises. It never rescues an anchor the cutoff rejects.
+    let exposureProof = null;
     if (req && Object.hasOwn(req, "exposureHeight")) {
+      const exposureHeight = req.exposureHeight;   // ONE read; the gate and the evidence share it
       const exp = proveExposureRelativePrimacy({
-        subjectClassicalPub: cert?.classicalPub,
-        entries: anchorEvidence.entries, sth: anchorEvidence.sth, expectedLogId,
-        exposureHeight: req.exposureHeight,
-        otsHex: anchorEvidence.otsHex, blockMerkleRoots: req.blockMerkleRoots,
+        subjectClassicalPub: subjectPub,
+        entries: ev.entries, sth: ev.sth, expectedLogId,
+        exposureHeight,
+        otsHex: ev.otsHex, blockMerkleRoots: req.blockMerkleRoots,
       });
       if (!exp.exposureRelative) {
         return refuse(REFUSED.ANCHOR_UNRESOLVED,
@@ -179,8 +266,9 @@ export function authorizeAndSign(req) {
             : `Exposure-relative primacy could not be established (${exp.reason}).`,
           { exposure: exp });
       }
-      // Carry the stronger evidence forward so the caller can see WHY it was authorised.
-      req = { ...req, _exposureProof: exp };
+      // Held in a LOCAL. It never re-enters the caller's object, so nothing the caller
+      // supplies can impersonate a proof this engine did not run.
+      exposureProof = exp;
     }
 
     // PRIMACY, not membership. The anchor is the EARLIEST binding of this certificate's
@@ -190,9 +278,9 @@ export function authorizeAndSign(req) {
     // below the cutoff separates them. `requireTemporalFrontier` defaults to true and this
     // engine never turns it off.
     const anchor = certIsFirstSeen({
-      cert, entries: anchorEvidence.entries, sth: anchorEvidence.sth, expectedLogId,
+      cert, entries: ev.entries, sth: ev.sth, expectedLogId,
       cutoffBlockHeight: req.cutoffBlockHeight,
-      otsHex: anchorEvidence.otsHex,
+      otsHex: ev.otsHex,
       blockMerkleRoots: req.blockMerkleRoots,
       requireTemporalFrontier: true,
     });
@@ -206,6 +294,67 @@ export function authorizeAndSign(req) {
         { anchor });
     }
 
+    // ── ROUND 7'S CRITICAL: THE ENGINE NEVER KNEW WHICH COIN IT WAS SIGNING ──────
+    // `spendDigest` is 32 opaque bytes chosen by whoever asks, and until now NOTHING tied
+    // them to an output. Our own siege stood up a SECOND, entirely legitimate client of the
+    // same custodian — its own first-seen certificate, honestly anchored strictly before its
+    // own exposure — and asked for a signature over the VICTIM's sighash. Every check passed
+    // and the policy key signed. The receipt named the bystander's fact hash while the coin
+    // belonged to someone else.
+    //
+    // This is not a corner case. It is precisely the deployment the paragraph below SELLS:
+    // one policy key across N tapscript leaves. Concentration without output binding turns
+    // every authorised client into a thief of every other client of the same custodian.
+    //
+    // The binding: the leaf governing a holder's output COMMITS to that holder's
+    // anchoredFactHash, so we can recompute the only scriptPubKey this certificate could
+    // legitimately govern and refuse if it is not the coin in front of us. Enforced whenever
+    // `spendContext` is supplied, with the same discipline as the cutoff: supplied means
+    // enforced, and refusal is the default on anything malformed.
+    // FAIL-CLOSED, NOT MERELY DOCUMENTED. A footgun you can step on by omission is a
+    // fail-open default with a paragraph next to it. There are exactly two safe
+    // configurations, and the caller must be in one of them ON PURPOSE:
+    //   (a) supply `spendContext` and the engine binds the authorisation to the coin; or
+    //   (b) assert `singlePolicyKeyPerHolder: true`, which is safe because a key that
+    //       governs one holder's outputs cannot be aimed at another holder's coin.
+    // Silence is neither, and silence is what round 7 exploited.
+    let outputBinding = null;
+    if (!req || (!Object.hasOwn(req, "spendContext") && req.singlePolicyKeyPerHolder !== true)) {
+      return refuse(REFUSED.OUTPUT_NOT_BOUND,
+        "This request does not say WHICH COIN it is for. `spendDigest` is 32 opaque bytes " +
+        "chosen by the requester, so without a binding this engine would authorise the " +
+        "holder rather than the spend — and under one shared policy key that lets any " +
+        "authorised client obtain a signature over any other client's sighash. Our own " +
+        "round-7 siege did exactly that. Supply `spendContext.prevoutScriptPubKey` (the " +
+        "34-byte P2TR scriptPubKey of the output being spent) and it will be ENFORCED, or " +
+        "state `singlePolicyKeyPerHolder: true` if this policy key governs exactly one " +
+        "holder's outputs. We will not pick for you, and we will not default to the unsafe one.");
+    }
+    if (req && Object.hasOwn(req, "spendContext")) {
+      const sc = req.spendContext;
+      const spk = sc && sc.prevoutScriptPubKey;
+      const given = spk instanceof Uint8Array ? spk.slice()
+        : (typeof spk === "string" ? fromHexP(spk) : null);
+      if (!given || given.length !== 34 || given[0] !== 0x51 || given[1] !== 0x20) {
+        return refuse(REFUSED.OUTPUT_NOT_BOUND,
+          "spendContext.prevoutScriptPubKey must be the 34-byte P2TR scriptPubKey of the " +
+          "output being spent (OP_1 PUSH32 <output key>). It is the only thing that makes " +
+          "this authorisation about a COIN rather than about a person.");
+      }
+      const expected = policyOutputScriptPubKey(anchor.anchoredFactHash,
+        schnorr.getPublicKey(policyKey));
+      if (!expected || toHex(expected) !== toHex(given)) {
+        return refuse(REFUSED.OUTPUT_NOT_BOUND,
+          "This output is not governed by THIS holder's commitment. The Taproot output key " +
+          "recomputed from the anchored first-seen fact hash and the policy key does not " +
+          "match the scriptPubKey being spent, so authorising it would let one client of " +
+          "this custodian spend another client's coin.",
+          { expectedScriptPubKeyHex: expected ? toHex(expected) : null,
+            presentedScriptPubKeyHex: toHex(given) });
+      }
+      outputBinding = { bound: true, scriptPubKeyHex: toHex(given) };
+    }
+
     const spend = verifySpend(cert, digest, pqSignatureHex, {
       anchoredFactHash: anchor.anchoredFactHash,
     });
@@ -228,15 +377,38 @@ export function authorizeAndSign(req) {
         ignoredUnsignedEntries: anchor.ignoredUnsignedEntries,
         temporalFrontier: anchor.temporalFrontier,
         quantumPropertyHolds: anchor.quantumPropertyHolds,
-        ...(req._exposureProof ? {
-          exposureRelative: true,
-          anchoredAtHeight: req._exposureProof.anchoredAtHeight,
-          exposureHeight: req._exposureProof.exposureHeight,
-          strength: req._exposureProof.strength,
-          whyThisIsStronger: "no Q-day estimate is involved: at the moment of anchoring the " +
-            "chain had not yet revealed this public key, so breaking secp256k1 was not " +
-            "sufficient to produce this commitment",
+        // DERIVED from the proof this engine ran, never a literal. Round 7 emitted a
+        // hardcoded `true` here, so an injected object produced the maximal claim with no
+        // proof behind it — including when the injected object itself said false.
+        ...(exposureProof ? {
+          exposureRelative: exposureProof.exposureRelative === true,
+          anchoredAtHeight: exposureProof.anchoredAtHeight,
+          exposureHeight: exposureProof.exposureHeight,
+          strength: exposureProof.strength,
+          // HONEST WORDING, round 7. The previous sentence said "no Q-day estimate is
+          // involved" about an authorisation that had ALSO required, and applied, the
+          // caller's cutoff. The exposure gate is a CONJUNCTION: it narrows, it never
+          // rescues. An anchor the cutoff rejects is still rejected however strong the
+          // exposure proof is.
+          whyThisIsStronger:
+            `this authorisation satisfied BOTH frontiers: the cutoff you chose ` +
+            `(H=${req.cutoffBlockHeight}), which is an estimate, AND — additionally — that ` +
+            `the commitment was anchored strictly before the chain first revealed this ` +
+            `public key. Only the SECOND of those depends on no Q-day estimate. It is an ` +
+            `extra condition, not a replacement for the first.`,
         } : {}),
+        // Stated on EVERY receipt, true or false, so its absence can never be mistaken for
+        // a guarantee that was never given.
+        outputBound: outputBinding !== null,
+        ...(outputBinding ? { boundScriptPubKeyHex: outputBinding.scriptPubKeyHex } : {
+          outputBindingCaveat:
+            "no spendContext was supplied. This receipt identifies the HOLDER, not the COIN: " +
+            "it records who was authorised to make the policy key sign SOMETHING. It is only " +
+            "sound because the caller ASSERTED singlePolicyKeyPerHolder — an assertion this " +
+            "engine cannot verify. If that assertion is false, this receipt does not mean " +
+            "what it appears to mean.",
+          singlePolicyKeyPerHolderAsserted: true,
+        }),
         digestSigned: toHex(digest),
         logId: anchor.logId,
         logPinned: true,
@@ -301,9 +473,20 @@ export const POLICY_SCOPE = Object.freeze({
     "the policy key and nothing else, so a quantum adversary who reaches that key spends " +
     "anyway. What this does is CONCENTRATE risk — N exposed classical keys become one " +
     "hash-hidden, rotatable, custodian-controlled key — and produce a post-quantum-signed, " +
-    "verifiable record of who SHOULD have been allowed to spend, giving the custodian a " +
-    "cryptographic reason to refuse. That is a real reduction in surface and a governance " +
-    "point. It is not immunity, and we will not describe it as one.",
+    "verifiable record of who was authorised to make that key sign. It is not immunity, and " +
+    "we will not describe it as one. NOTE THE CORRECTION: this string used to read 'who " +
+    "SHOULD have been allowed to spend', which claims a binding to a COIN that the engine " +
+    "only performs when `spendContext` is supplied — see outputBinding below.",
+  outputBinding:
+    "THE COIN IS ONLY BOUND WHEN YOU BIND IT. Supply `spendContext.prevoutScriptPubKey` and " +
+    "the engine recomputes the Taproot output key from THIS holder's anchoredFactHash and " +
+    "the policy key, and refuses any other output — enforced whenever supplied. OMIT IT and " +
+    "the authorisation is about the HOLDER, not the coin: the requester chooses 32 opaque " +
+    "digest bytes and nothing checks what they belong to. Round 7 of our own siege used that " +
+    "to have one legitimate client of a custodian obtain a policy-key signature over another " +
+    "client's sighash — which is exactly the 'concentration' deployment described above. " +
+    "Either supply spendContext, or run ONE POLICY KEY PER HOLDER. Every receipt states " +
+    "`outputBound` so its absence can never be mistaken for a guarantee.",
   limitFour_historyNotPinned:
     "pinning the log IDENTITY does not pin its HISTORY. Two same-size heads under the same " +
     "logId both satisfy every check here. Split view is DETECTABLE (transparency." +
@@ -311,11 +494,15 @@ export const POLICY_SCOPE = Object.freeze({
     "witness, mirror or gossip channel and the engine refuses on any contradiction; without " +
     "them you are trusting the log to have shown you its only history.",
   exposureRelativeGate:
-    "if `exposureHeight` is supplied it is ENFORCED, never advisory — a parameter that can " +
-    "be passed and silently dropped is worse than one that does not exist. When enforced, " +
-    "authorisation requires the commitment to have been anchored strictly before the chain " +
-    "first revealed the key, which needs no Q-day estimate. Omit it and the engine falls " +
-    "back to the cutoff frontier, which is a guess and says so.",
+    "if `exposureHeight` is supplied as an OWN property it is ENFORCED, never advisory — a " +
+    "parameter that can be passed and silently dropped is worse than one that does not " +
+    "exist. When enforced, authorisation ADDITIONALLY requires the commitment to have been " +
+    "anchored strictly before the chain first revealed the key, and THAT condition needs no " +
+    "Q-day estimate. It is a CONJUNCTION, never a substitution: cutoffBlockHeight stays " +
+    "mandatory and is still applied afterwards, so a commitment anchored at 800000 with " +
+    "exposure at 850000 is STILL refused under a cutoff of 790000. The gate narrows what " +
+    "authorises; it never rescues what the cutoff rejects. Omit it and the engine falls back " +
+    "to the cutoff frontier alone, which is a guess and says so.",
   precondition:
     "the true holder must have registered a dual-signed commitment BEFORE the cutoff. If " +
     "they never did, no one is authorised — not them, not an attacker. Those coins are " +

package/src/primacy.mjs

@@ -668,10 +668,24 @@ export const EXPOSURE_SCOPE = Object.freeze({
     "shared xpub, or anywhere off-chain was derivable earlier than this proof suggests. " +
     "The adversary's window opens at min(any publication of the key, on-chain exposure); " +
     "this kit measures the second.",
-  notAnAuthorisationGate:
-    "policy.mjs does not consume this. It is an independently verifiable proof primitive, " +
-    "not yet a mandatory gate on the signing path. Saying otherwise would be the sixth " +
-    "incarnation of the mistake this package documents.",
+  isAnAuthorisationGate:
+    "policy.mjs DOES consume this. If authorizeAndSign receives `exposureHeight` as an own " +
+    "property, exposure-relative primacy becomes a NECESSARY condition for signing and the " +
+    "engine refuses without it. It stays opt-in: omit the field and the engine falls back " +
+    "to the cutoff frontier. (This string previously said the opposite and stayed stale " +
+    "after M2 wired the gate — round 7 caught the package contradicting itself in its own " +
+    "machine-readable scope. That is the disease, with the polarity inverted.)",
+  narrowsNeverRescues:
+    "the gate is a CONJUNCTION, never a substitution. cutoffBlockHeight remains mandatory " +
+    "and certIsFirstSeen still applies it AFTER this check, so an anchor at 800000 with " +
+    "exposure at 850000 — the strongest position this scheme can give — is still REFUSED " +
+    "under a cutoff of 790000. Supplying an exposure height narrows what authorises; it " +
+    "never rescues what the cutoff rejects.",
+  blindToTheCertificate:
+    "proveExposureRelativePrimacy judges by `subjectClassicalPub` ALONE — it never sees the " +
+    "certificate presented. In policy.mjs that composes correctly, because certIsFirstSeen " +
+    "kills the post-Shor rebinding attacker afterwards. Used ON ITS OWN as a gate, this " +
+    "primitive AUTHORISES that attacker. If you reuse it, compose it as policy.mjs does.",
   exposureHeightIsNotOurs:
     "the verifier supplies it from their own node. An exposure height we asserted would be " +
     "one more thing to trust us about, and the point is that it is independently checkable.",

package/test/m2-policy.mjs

@@ -99,7 +99,7 @@ const evidence = { sth, entries: entryList };
 const HEADERS = { 800000: "aa".repeat(32) };
 const base = { cert, spendDigest: digest, pqSignatureHex: pqSig, anchorEvidence: evidence,
   expectedLogId: sth.logId, policyKey: policyPriv, cutoffBlockHeight: CUTOFF,
-  blockMerkleRoots: HEADERS };
+  blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true };
 {
   check("REFUSES with no transparency-log evidence at all",
     authorizeAndSign({ ...base, anchorEvidence: undefined }).reason === REFUSED.NO_ANCHOR_EVIDENCE);
@@ -108,7 +108,7 @@ const base = { cert, spendDigest: digest, pqSignatureHex: pqSig, anchorEvidence:
   check("★ REFUSES when no Q-day cutoff is supplied — it will not guess it for you",
     authorizeAndSign({ ...base, cutoffBlockHeight: undefined }).reason === REFUSED.NO_ANCHOR_EVIDENCE);
   check("★ REFUSES when no block headers are supplied — the .ots alone is not a Bitcoin fact",
-    authorizeAndSign({ ...base, blockMerkleRoots: undefined }).detail.includes("never from the bundle"));
+    authorizeAndSign({ ...base, blockMerkleRoots: undefined, singlePolicyKeyPerHolder: true }).detail.includes("never from the bundle"));
   check("REFUSES when the entry list is incomplete (primacy cannot be proven)",
     authorizeAndSign({ ...base, anchorEvidence: { ...evidence, entries: entryList.slice(0, 1) } }).reason === REFUSED.ANCHOR_UNRESOLVED);
   check("REFUSES when the log is the WRONG log",

package/test/primacy.mjs

@@ -189,7 +189,7 @@ console.log("\n★★★ ROUND 3 — what Bitcoin freezes is the PROOF OF CONTRO
   const HEADERS = { [real.height]: real.root }; HDRS = HEADERS;     // what a verifier gets from THEIR node
 
   // (a) THE POSITIVE PATH — the test that did not exist in any previous round.
-  const ok = establishTemporalFrontier({ headBytes, otsHex, cutoffBlockHeight: 900_000, blockMerkleRoots: HEADERS });
+  const ok = establishTemporalFrontier({ headBytes, otsHex, cutoffBlockHeight: 900_000, blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true });
   check("★ (a) POSITIVE PATH: header-confirmed anchor below the cutoff ESTABLISHES the frontier",
     ok.established === true && ok.headerConfirmed === true && ok.height === real.height);
 
@@ -208,17 +208,17 @@ console.log("\n★★★ ROUND 3 — what Bitcoin freezes is the PROOF OF CONTRO
     f.timestamp.attestations = [...(f.timestamp.attestations || []), { kind: "bitcoin", height: 1 }];
     return T.toHex(O.encodeOtsFile(f));
   })();
-  const t = establishTemporalFrontier({ headBytes, otsHex: tampered, cutoffBlockHeight: 500, blockMerkleRoots: HEADERS });
+  const t = establishTemporalFrontier({ headBytes, otsHex: tampered, cutoffBlockHeight: 500, blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true });
   check("★ (d) REGRESSION: grafting {bitcoin, height:1} no longer downgrades a real anchor",
     t.established === false);
   check("...and the real anchor is still selected when the cutoff allows it",
     establishTemporalFrontier({ headBytes, otsHex: tampered, cutoffBlockHeight: 900_000,
-      blockMerkleRoots: HEADERS }).height === real.height);
+      blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true }).height === real.height);
 
   // (e) a .ots forged from scratch, claiming a height the verifier never enumerated.
   check("★ (e) FIX: a forged .ots claiming an unenumerated height is REFUSED, not skipped",
     establishTemporalFrontier({ headBytes, otsHex: mkOts(123), cutoffBlockHeight: 900_000,
-      blockMerkleRoots: HEADERS }).reason === "no-attestation-header-confirmed");
+      blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true }).reason === "no-attestation-header-confirmed");
 
   // (f) THE DECISIVE ONE: squat a bare pair pre-cutoff, attach signatures after Shor.
   const attacker2 = generateMigrationIdentity();
@@ -251,7 +251,7 @@ console.log("\n★★★ ROUND 3 — what Bitcoin freezes is the PROOF OF CONTRO
     authorizeAndSign(req).detail.includes("never from the bundle you are judging"));
 
   // …and AUTHORISES when every condition, including the header, is satisfied.
-  const good = authorizeAndSign({ ...req, blockMerkleRoots: HEADERS });
+  const good = authorizeAndSign({ ...req, blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true });
   check("★★★ POSITIVE PATH END TO END: authorised, with a header-confirmed frontier",
     good.authorized === true && good.evidence.quantumPropertyHolds === true &&
     good.evidence.temporalFrontier.headerConfirmed === true);
@@ -262,15 +262,15 @@ console.log("\n★★★ ROUND 3 — what Bitcoin freezes is the PROOF OF CONTRO
   for (const bad of [NaN, "abc", Infinity, -1, 1.5, "900000", true, [900000]]) {
     check(`★ cutoff ${JSON.stringify(bad) ?? String(bad)} is REFUSED, never coerced`,
       establishTemporalFrontier({ headBytes: headBytes, otsHex, cutoffBlockHeight: bad,
-        blockMerkleRoots: HEADERS }).established === false);
+        blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true }).established === false);
   }
   check("★ and the policy engine refuses a malformed cutoff with its own reason",
-    authorizeAndSign({ ...req, cutoffBlockHeight: NaN, blockMerkleRoots: HEADERS })
+    authorizeAndSign({ ...req, cutoffBlockHeight: NaN, blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true })
       .detail.includes("refused rather than coerced"));
 
   check("★ a forged .ots does NOT authorise, even with everything else correct",
     authorizeAndSign({ ...req, anchorEvidence: { ...req.anchorEvidence, otsHex: mkOts(123) },
-      blockMerkleRoots: HEADERS }).authorized === false);
+      blockMerkleRoots: HEADERS, singlePolicyKeyPerHolder: true }).authorized === false);
 }
 
 console.log("\nThe three irreducible limits, stated in the code itself:");
@@ -302,7 +302,7 @@ console.log("\n★ LIMIT #4 — pinning the log's IDENTITY does not pin its HIST
   const d3 = sha256(te.encode("spend-3"));
   const base3 = { cert: victimCert, spendDigest: d3, pqSignatureHex: authorizeSpend(victim, d3),
     anchorEvidence: { sth: head.sth, entries, otsHex: OTS }, expectedLogId: LOG_ID,
-    policyKey: policyPriv3, cutoffBlockHeight: 900_000, blockMerkleRoots: HDRS };
+    policyKey: policyPriv3, cutoffBlockHeight: 900_000, blockMerkleRoots: HDRS, singlePolicyKeyPerHolder: true };
   check("without knownHeads the engine authorises — it cannot see the other history",
     authorizeAndSign(base3).authorized === true);
   check("★★ WITH a contradicting head supplied, the engine REFUSES (not warns)",
@@ -335,7 +335,7 @@ console.log("\n★★★ PRIMACÍA RELATIVA A LA EXPOSICIÓN — no depende de a
 {
   const { proveExposureRelativePrimacy, EXPOSURE_SCOPE } = await import("../src/primacy.mjs");
   const common = { subjectClassicalPub: victimCert.classicalPub, entries, sth: STH_A,
-    expectedLogId: LOG_ID, otsHex: OTS, blockMerkleRoots: HDRS };
+    expectedLogId: LOG_ID, otsHex: OTS, blockMerkleRoots: HDRS, singlePolicyKeyPerHolder: true };
 
   // El ancla real está en el bloque 800000 (ver el montaje de arriba).
   const before = proveExposureRelativePrimacy({ ...common, exposureHeight: 850_000 });
@@ -360,7 +360,7 @@ console.log("\n★★★ PRIMACÍA RELATIVA A LA EXPOSICIÓN — no depende de a
   check("una altura de exposición malformada se rehúsa, no se coerciona",
     proveExposureRelativePrimacy({ ...common, exposureHeight: NaN }).exposureRelative === false);
   check("sin ancla confirmada por cabecera no se hace ninguna afirmación fuerte",
-    proveExposureRelativePrimacy({ ...common, blockMerkleRoots: undefined, exposureHeight: 850_000 })
+    proveExposureRelativePrimacy({ ...common, blockMerkleRoots: undefined, singlePolicyKeyPerHolder: true, exposureHeight: 850_000 })
       .exposureRelative === false);
 
   check("HONESTIDAD: declara a quién NO puede salvar (claves ya expuestas)",
@@ -375,7 +375,7 @@ console.log("\n★★★ M2 CABLEADO — el gate de exposición en la ruta de fi
   const d4 = sha256(te.encode("spend-m2"));
   const req4 = { cert: victimCert, spendDigest: d4, pqSignatureHex: authorizeSpend(victim, d4),
     anchorEvidence: { sth: head.sth, entries, otsHex: OTS }, expectedLogId: LOG_ID,
-    policyKey: policyPriv4, cutoffBlockHeight: 900_000, blockMerkleRoots: HDRS };
+    policyKey: policyPriv4, cutoffBlockHeight: 900_000, blockMerkleRoots: HDRS, singlePolicyKeyPerHolder: true };
 
   // El ancla está en el bloque 800000 (montaje de arriba).
   const ok = authorizeAndSign({ ...req4, exposureHeight: 850_000 });