fractal-pqc 0.8.0 → 0.9.0

package/README.md

@@ -134,15 +134,35 @@ so the property is never silently over-claimed.
 
 ## What this is NOT
 
-> **ONE POLICY KEY PER HOLDER — OR BIND THE OUTPUT.** `authorizeAndSign` reads a 32-byte
-> `spendDigest` chosen by the requester. Round 7 of our own siege used that to have one
-> *legitimate* client of a custodian obtain a policy-key signature over **another client's
-> sighash** — which is exactly the "concentration" deployment this package describes. The
-> engine now **refuses any request that does not say which coin it is for**: supply
-> `spendContext.prevoutScriptPubKey` (enforced against the holder's own anchored commitment)
-> or explicitly assert `singlePolicyKeyPerHolder: true`. Silence is refused. Residual, stated
-> rather than hidden: the engine checks the scriptPubKey the commitment governs, it does not
-> recompute the BIP-341 sighash from the transaction.
+> **NEVER SIGN A DIGEST YOU DID NOT COMPUTE YOURSELF.** Until 0.9.0 `authorizeAndSign` read a
+> 32-byte `spendDigest` chosen by the requester, and round 7 of our own siege used that to have
+> one *legitimate* client of a custodian obtain a policy-key signature over **another client's
+> sighash**. The round-7 fix compared the presented scriptPubKey against one recomputed from the
+> requester's fact hash — and round 8 walked through it, because **both sides of that comparison
+> were the requester's**.
+>
+> An engine that signs a digest it was handed is not a policy engine, it is a signing **oracle**,
+> and no guard around it helps: every check then compares values the caller controls. So the
+> caller no longer supplies a digest. It supplies the **transaction**:
+>
+> ```js
+> authorizeAndSign({ cert, pqSignatureHex, anchorEvidence, expectedLogId, policyKey,
+>                    cutoffBlockHeight, blockMerkleRoots,
+>                    spendContext: { tx, inputIndex, prevoutValues, prevoutScriptPubKeys } })
+> ```
+>
+> `spendContext` is **mandatory** and a request carrying `spendDigest` is refused at the door.
+> The engine recomputes the Taproot output key from the holder's **anchored** first-seen fact
+> hash, requires the prevout at `inputIndex` to be that coin, and then derives the BIP-341
+> sighash **itself**. Use `buildSpendContext()` — the same helper a custodian uses — so the
+> holder signs exactly the bytes the policy key will sign.
+>
+> **THE TWO RESIDUALS, stated rather than hidden.** (1) The engine imposes **nothing on the
+> outputs**: it proves *whose* coin is spent and *who* authorised it, never *where* the value
+> goes. (2) `buildSpendContext` builds a **single-input** transaction while the engine accepts
+> multi-input ones, so for those the holder cannot re-derive the digest with the shipped helper
+> and would be signing a digest the custodian computed — the very mistake this section is about.
+> **The holder must inspect the transaction, not merely sign the digest they were handed.**
  (honest scope — do not overstate)
 
 - **Not yet confirmed in a live mempool.** The sighash is proven consensus-correct against

package/bin/cli.mjs

@@ -237,7 +237,7 @@ switch (cmd) {
   case "selftest": {
     const r = spawnSync(process.execPath, [join(__dirname, "..", "test", "vectors.mjs")], { stdio: "inherit" });
     if ((r.status ?? 1) !== 0) process.exit(r.status ?? 1);
-    for (const f of ["transparency.mjs", "primacy.mjs", "anchoring.mjs", "conformance.mjs", "m2-policy.mjs", "bip341-scriptpath.mjs", "claims.mjs", "letter-claims.mjs"]) {
+    for (const f of ["transparency.mjs", "primacy.mjs", "anchoring.mjs", "conformance.mjs", "m2-policy.mjs", "bip341-scriptpath.mjs", "claims.mjs", "demo.mjs", "letter-claims.mjs"]) {
       const t = spawnSync(process.execPath, [join(__dirname, "..", "test", f)],
         { stdio: "inherit", env: { ...process.env, FRACTAL_SELFTEST_DEPTH: "1" } });
       if ((t.status ?? 1) !== 0) process.exit(t.status ?? 1);
@@ -247,6 +247,14 @@ switch (cmd) {
 
   // Run every checkable assertion in the letter against this package. The letter cannot be
   // sent if this is not green — which is the entire point of building it.
+  // The whole story in one run: identity -> commitment -> log -> Bitcoin anchor ->
+  // offline verification -> the custodian decision, and the six refusals. The enforcement
+  // point had no CLI verb at all, so a reviewer could read about it and never run it.
+  case "demo": {
+    const { runDemo } = await import("../src/demo.mjs");
+    process.exit(await runDemo());
+  }
+
   case "verify-letter": {
     const { verifyLetter } = await import("../src/verify-letter.mjs");
     const { SHIPPED_LETTER } = await import("../src/letter-claims.mjs");
@@ -451,8 +459,16 @@ Usage:
                                            shipped here and proves each claim DIES when the
                                            code it names is broken. A claim no mutation can
                                            kill is vacuous, and is reported as such.
+  fractal-pqc demo                         THE WHOLE STORY, offline, in one run: identity,
+                                           dual-signed commitment, transparency log, Bitcoin
+                                           anchor, offline verification, and the custodian
+                                           policy engine authorising the rightful holder and
+                                           REFUSING six attacks — including a post-quantum
+                                           adversary holding the victim's classical key.
+  fractal-pqc verify-letter [file]         Check every factual assertion in our letter
+                                           against this package. Exits non-zero if any fails.
   fractal-pqc verify-vector                Check the official BIP-340 test vector
-  fractal-pqc selftest                     Run everything: 315 real checks, no mocks
+  fractal-pqc selftest                     Run everything: 331 real checks, no mocks
 
 Docs: integrations/pqc-migration-kit/README.md`);
     process.exit(cmd ? 1 : 0);

package/letter/galaxy-2026-08-31.md

@@ -14,11 +14,11 @@ Three layers. Two exist and are published. The third does not exist, and I won't
 
 **Layer 3 — Consensus (does NOT exist).** Bitcoin does not reject a spend for lacking a PQ signature, and nothing we ship changes that. I'll be blunter than the pitch requires: the only thing consensus ever checks is a classical Schnorr signature on the policy key. A quantum adversary who reaches that key spends anyway. What this construction actually buys is **concentration** — N exposed classical keys become one hash-hidden, rotatable, custodian-controlled key — plus a post-quantum-signed record of who was authorised to make that key sign, giving the custodian a cryptographic reason to refuse everyone else. That is a real reduction in attack surface and a governance mechanism. **It is not immunity, and we removed the sentence that said it was.**
 
-One correction I owe you inside this same paragraph, because it is the finding of our seventh siege and it lands squarely on the sentence above. That sentence used to read "a record of who *should have been allowed to spend*", and until days before this email that was an overclaim: the engine received the spend digest as 32 opaque bytes and never learned **which output** it was signing for. Our own siege stood up a second, entirely legitimate client of the same custodian and had it obtain a policy-key signature over the **first client's** sighash. Every check passed. The concentration this paragraph describes — one policy key across many leaves — is precisely the deployment in which that is theft. It is fixed in `0.8.0`: the leaf commits to the holder's own anchored fact hash, the engine recomputes the output key from it, and **a request that does not say which coin it is for is refused** rather than defaulted. A footgun you step on by omission is a fail-open default with a paragraph next to it.
+One correction I owe you inside this same paragraph, because it is the finding of our seventh siege and it lands squarely on the sentence above. That sentence used to read "a record of who *should have been allowed to spend*", and until days before this email that was an overclaim: the engine received the spend digest as 32 opaque bytes and never learned **which output** it was signing for. Our own siege stood up a second, entirely legitimate client of the same custodian and had it obtain a policy-key signature over the **first client's** sighash. Every check passed. The concentration this paragraph describes — one policy key across many leaves — is precisely the deployment in which that is theft. It is fixed in `0.9.0`: the leaf commits to the holder's own anchored fact hash, the engine recomputes the output key from it, and **a request that does not say which coin it is for is refused** rather than defaulted. A footgun you step on by omission is a fail-open default with a paragraph next to it.
 
 **2) You can run all of it, right now, without believing any of this**
 
-Including this email. It makes fourteen factual assertions — every count, every block
+Including this email. It makes eighteen factual assertions — every count, every block
 height, every version, and five sentences about what the engine does. Each one is registered
 with an executable check that reads the asserted value **out of this letter** and compares it
 to a value measured from the package. Change a number in the letter and the check reads the
@@ -31,22 +31,38 @@ npx fractal-pqc verify-letter   # this email, checked against the code, on your
 
 The letter you are reading ships inside the package, so you can also confirm nothing was
 altered between my sending it and your reading it. **If any assertion fails, this email is
-wrong — and you will know before I do.** It also prints, in the same output, the four things
-in here that no check covers: two judgements, one hand-counted aggregate, and every
-forward-looking commitment. Those are opinions and promises, and we refuse to report them as
-verified.
+wrong — and you will know before I do.** It also prints, in the same output, the five things in here that no check covers: two judgements, one hand-counted aggregate, one historical figure that can no longer be re-measured, and every forward-looking commitment. Those are opinions, memories and promises, and we refuse to report them as verified.
 
 I built that tool because of the disease in section 5, and I built it for this letter
 specifically. It found three false numbers in my own draft before you saw it.
 
 ```
-npm i fractal-pqc@0.8.0
+npm i fractal-pqc@0.9.0
+npx fractal-pqc demo            # the whole path, offline, in 20 seconds — see below
 npx fractal-pqc claims          # every security claim we make, each with an attack
 npx fractal-pqc claims --gaps   # and what the green does NOT cover
 npx fractal-pqc claims --mutate # break the code, watch the sentences die
-npx fractal-pqc selftest        # 315 checks, no mocks
+npx fractal-pqc selftest        # 331 checks, no mocks
 ```
 
+**Start with `demo`.** It is the answer to your question, executed rather than described.
+In one offline run it generates a holder identity, dual-signs a migration commitment, appends
+it to an RFC 6962 log, signs the head with ML-DSA-65, anchors it, verifies the anchor by
+recomputing everything — and then runs the custodian policy engine. That last part is the
+point, and it is why most of what you will watch are **refusals**: the engine authorises the
+rightful holder once, and then refuses six times. Including this one, which is the attack the
+whole design exists for:
+
+> *a post-quantum adversary who already HOLDS the victim's classical key, produces a genuinely
+> valid dual-signed rebinding, and an honest append-only log accepts it — and the engine still
+> refuses, because the attacker loses on PRIMACY, not on the signature.*
+
+The demo names the synthetic parts (there is no network call, so the Bitcoin attestation is
+constructed locally and it says so on the line where it matters), and it ends by naming the
+ceiling: consensus only ever checks a classical Schnorr signature, so this is not immunity.
+It is also a test — `test/demo.mjs` fails the build if any of those six refusals ever starts
+authorising, which is the only reason I am willing to put it in this email.
+
 Published today. `verify-anchor` verifies a bundle offline: the tree head's ML-DSA-65 signature, the inclusion proof with the Merkle root **recomputed** rather than compared to one we hand you, an RFC 6962 consistency proof that no history was rewritten, and a Bitcoin anchor derived from the OpenTimestamps proof alone — height and Merkle root, which you then check against a header from **your own node**. We are not in that path.
 
 A bundle ships in the package so you can run that path end to end;
@@ -76,7 +92,7 @@ What remains is, deliberately, **precisely what we cannot do alone**:
 | # | What remains | Why money is required for it | Amount |
 |---|---|---|---|
 | ~~M1~~ | ~~Bitcoin-anchored first-seen registry~~ | **DELIVERED — `npx fractal-pqc verify-anchor`** | **$0** |
-| **M2** | **Exposure-relative primacy, in a real custodian's signing flow** — the design is below, and the primitive is already shipped and enforced in `fractal-pqc@0.8.0`. What remains is a *custodian* running it against funded testnet spends | The code, the BIP-341 conformance and the gate exist. What is missing is a custodian, and custodian engineering time is what money buys | $120,000 |
+| **M2** | **Exposure-relative primacy, in a real custodian's signing flow** — the design is below, and the primitive is already shipped and enforced in `fractal-pqc@0.9.0`. What remains is a *custodian* running it against funded testnet spends | The code, the BIP-341 conformance and the gate exist. What is missing is a custodian, and custodian engineering time is what money buys | $120,000 |
 
 **Tranche 2 — $80,000** — **independent external review**, published in full including negative findings, plus multisig PSBT and key rotation (today a lost ML-DSA secret is a permanent lockout, and the package says so). We cannot review ourselves; this is the one deliverable whose entire value comes from it not being us.
 **Tranche 3 — $120,000** — public specification, wallet interoperability, long-term maintenance of the vectors. Success measured by independent adopters, not by our own claims.
@@ -95,6 +111,8 @@ Where that inequality holds, the proof depends on **no Q-day date**: at the mome
 
 It is wired as a **gate**, not a report: `authorizeAndSign({ …, exposureHeight })` refuses and releases no signature when the commitment was anchored after exposure. Supplied means **enforced** — a parameter that can be passed and silently dropped is worse than one that does not exist.
 
+And one structural change our eighth siege forced, which I would rather you heard from me: **the engine computes the digest it signs and refuses any request that carries one.** Until last week it accepted a 32-byte digest from the caller, which makes it a signing *oracle* — every check it performs then compares two values the caller controls. Our own siege used that to have one legitimate client of a custodian obtain a policy-key signature over another client's coin. The caller now supplies the transaction; the engine derives the BIP-341 sighash itself, over the prevout it verified belongs to that holder.
+
 And the precise shape of it, which our seventh siege made us state properly: **this gate is a conjunction, never a substitution.** The cutoff you choose stays mandatory and is still applied afterwards, so a commitment anchored at 800,000 with exposure at 850,000 — the strongest position this scheme can give anyone — is still refused under a cutoff of 790,000. Supplying an exposure height *narrows* what authorises; it never rescues what the cutoff rejects. What is true, and is the whole point, is that the second condition depends on no Q-day estimate. The receipt now says exactly that, in those words, instead of the flatter sentence it used to print.
 
 The claim is bounded, and we say so in the code itself:
@@ -116,7 +134,7 @@ We are not the standard, and anyone claiming to be one at this stage is selling.
 
 **Ours is the only package I know of that will tell you, on your machine, which of its own security claims it cannot back.** A claim is admissible only with three things: an executable proof, an executable *attack* that must fail, and a **mutation** of the code it names under which the claim must fail. A sentence no mutation can kill is reported as vacuous and the build breaks.
 
-We built that because we needed it. Seven adversarial siege rounds against our own code — roughly 900 executed exploits — found the same disease every time and never once in the mathematics: an English sentence and a code path written separately, with a fully green test suite in between hiding the gap. Round 5 deleted a single line binding an anchor to the head it timestamps; the ledger printed all-green and 263 assertions passed, because no claim named that guard. Round 7 — run against the very paragraph in section 3b, in the days before this email — found the cross-client signature described in section 1, and found a frozen scope string still telling auditors that the M2 gate did not exist while the gate was refusing signatures. Every mutation in the matrix reintroduces a bug that really shipped in this package, tagged with the round that caught it. **The matrix is simultaneously our test harness and the public record of our own failures.**
+We built that because we needed it. Ten adversarial siege rounds against our own code — roughly 1,150 executed exploits — found the same disease every time and never once in the mathematics: an English sentence and a code path written separately, with a fully green test suite in between hiding the gap. Round 5 deleted a single line binding an anchor to the head it timestamps; the ledger printed all-green and 263 assertions passed, because no claim named that guard. Round 7 — run against the very paragraph in section 3b, in the days before this email — found the cross-client signature described in section 1, and found a frozen scope string still telling auditors that the M2 gate did not exist while the gate was refusing signatures. Round 10, run against this exact letter before it was sent: `cutoffBlockHeight`, `blockMerkleRoots` and `knownHeads` were each read straight off the request at every point they were needed, instead of being snapshotted once the way `anchorEvidence` already was — and for `knownHeads` that was not a theoretical gap. An accessor that shows a genuinely conflicting log head to the length check and an empty array to the loop that actually runs equivocation detection produced a real, verifiable ML-DSA-gated Schnorr signature in exactly the case section 4's limit #4 promises a refusal for. All three fields now get the same snapshot-once discipline. The `knownHeads` and `cutoffBlockHeight` exploits are each closed and covered by a mutation that turns the ledger red if either regresses. `blockMerkleRoots` got the identical fix on the identical reasoning, but we could not construct an attack that flips authorisation through it alone — every consumer looks the anchor height up by key, so a divergent read fails closed rather than open — and we are not shipping a mutation we cannot honestly make fail; that field's hardening is disclosed as defense-in-depth, not as the closure of a demonstrated bypass. Every mutation in the matrix reintroduces a bug that really shipped in this package, tagged with the round that caught it. **The matrix is simultaneously our test harness and the public record of our own failures.**
 
 I am telling you about round 7 in the letter that asks you for money, before you could possibly have found it yourself, because the alternative is a commitment on the next page that would be worth nothing.
 
@@ -125,7 +143,7 @@ That is also why the retraction in section 1 is a *test*, not a footnote: the ol
 **Four commitments that go with the money**
 
 1. **Every deliverable arrives with its own post-quantum receipt, Bitcoin-anchored.** You verify our work using the mechanism you're funding.
-2. **Public failure clause.** If anyone — including us — breaks the binding scheme during the grant, we publish it in full within 72 hours and stop invoicing until it's fixed. Our own siege has broken it seven times, the most recent one in the days before this email; that's not a hypothetical policy.
+2. **Public failure clause.** If anyone — including us — breaks the binding scheme during the grant, we publish it in full within 72 hours and stop invoicing until it's fixed. Our own siege has broken it ten times, the most recent one in the days before this email; that's not a hypothetical policy.
 3. **Vectors stay CC0.** 33 of them are already published. Whoever runs them owns their own verification.
 4. **Non-dilutive, open source, no exclusivity.**
 

package/package.json

@@ -1,15 +1,13 @@
 {
   "name": "fractal-pqc",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",
   "author": "FractalAI",
   "homepage": "https://fractalai.net.co",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/fractalai/fractal-ai",
-    "directory": "integrations/pqc-migration-kit"
+  "bugs": {
+    "email": "helloinvestor@fractalai.net.co"
   },
   "engines": {
     "node": ">=18"
@@ -44,14 +42,15 @@
     "vectors"
   ],
   "scripts": {
-    "test": "node test/vectors.mjs && node test/transparency.mjs && node test/primacy.mjs && node test/anchoring.mjs && node test/conformance.mjs && node test/m2-policy.mjs && node test/bip341-scriptpath.mjs && node test/claims.mjs && node test/letter-claims.mjs",
+    "test": "node test/vectors.mjs && node test/transparency.mjs && node test/primacy.mjs && node test/anchoring.mjs && node test/conformance.mjs && node test/m2-policy.mjs && node test/bip341-scriptpath.mjs && node test/claims.mjs && node test/demo.mjs && node test/letter-claims.mjs",
     "selftest": "node bin/cli.mjs selftest",
     "conformance": "node test/conformance.mjs",
     "claims": "node bin/cli.mjs claims",
     "mutate": "node bin/cli.mjs claims --mutate",
     "attribution": "node bin/cli.mjs claims --attribution",
     "gaps": "node bin/cli.mjs claims --gaps",
-    "verify-letter": "node bin/cli.mjs verify-letter"
+    "verify-letter": "node bin/cli.mjs verify-letter",
+    "demo": "node bin/cli.mjs demo"
   },
   "dependencies": {
     "@noble/curves": "^2.2.0",

package/src/claims-registry.mjs

@@ -10,9 +10,11 @@ import { sha256 } from "@noble/hashes/sha2.js";
 import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
 import * as T from "./transparency.mjs";
 import * as P from "./primacy.mjs";
+import { certIsFirstSeen } from "./primacy.mjs";
+const toHexLocal = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
 import * as TS from "./tapscript.mjs";
 import * as OTS from "./ots.mjs";
-import { POLICY_SCOPE, authorizeAndSign, REFUSED, policyOutputScriptPubKey } from "./policy.mjs";
+import { POLICY_SCOPE, authorizeAndSign, REFUSED, policyOutputScriptPubKey, buildSpendContext } from "./policy.mjs";
 import { schnorr } from "@noble/curves/secp256k1.js";
 import { generateMigrationIdentity, createMigrationCommitment, authorizeSpend } from "./migration-envelope.mjs";
 
@@ -60,19 +62,29 @@ const REAL_ROOT = (() => {
 const HEADERS = { [ANCHOR_HEIGHT]: REAL_ROOT };
 const CUTOFF = 900_000;
 const POLICY_KEY = new Uint8Array(32).fill(0x2b);
-const DIGEST = sha256(te.encode("a real spend"));
-const SPEND_SIG = authorizeSpend(ident, DIGEST);
+// The anchored first-seen fact hash is what the holder's output key is derived from, so it
+// has to be resolved before a spend context can exist. Round 8 removed the option of making
+// one up: there is no digest to hand in any more.
+const ANCHORED_FH = certIsFirstSeen({
+  cert, entries: ENTRIES, sth: STH, expectedLogId: STH.logId, cutoffBlockHeight: CUTOFF,
+  otsHex: OTS_HEX, blockMerkleRoots: HEADERS, requireTemporalFrontier: true,
+}).anchoredFactHash;
+const SC = buildSpendContext({
+  anchoredFactHash: ANCHORED_FH, policyPublicKey: schnorr.getPublicKey(POLICY_KEY),
+  txid: "11".repeat(32), valueSats: 100_000n,
+  outputs: [{ valueSats: 90_000n, scriptPubKey: new Uint8Array(34) }],
+});
+const SPEND_SIG = authorizeSpend(ident, SC.digest);
 
 /** A request that ACTUALLY AUTHORISES. Attacks perturb exactly one field of it. */
 const goodReq = () => ({
-  cert, spendDigest: DIGEST, pqSignatureHex: SPEND_SIG,
+  cert, pqSignatureHex: SPEND_SIG,
   anchorEvidence: { sth: STH, entries: ENTRIES, otsHex: OTS_HEX },
   expectedLogId: STH.logId, policyKey: POLICY_KEY,
   cutoffBlockHeight: CUTOFF, blockMerkleRoots: HEADERS,
-  // Round 7 made this explicit rather than defaulted: the engine refuses a request that
-  // does not say WHICH coin it is for. These fixtures are single-holder scenarios, so they
-  // assert the safe deployment instead of silently relying on it.
-  singlePolicyKeyPerHolder: true,
+  // Round 8: the engine COMPUTES the digest from this. There is no digest field any more,
+  // because a digest the caller chooses is a signing oracle no matter what guards surround it.
+  spendContext: SC.spendContext,
 });
 
 export const CLAIMS = [
@@ -232,43 +244,181 @@ export const CLAIMS = [
   {
     id: "R7-output-binding-or-refusal",
     module: "policy.mjs",
-    statement: "The engine never signs without knowing WHICH coin it signs for. Either the " +
-               "caller binds the spend to an output (enforced against the holder's own " +
-               "anchored commitment) or the caller explicitly asserts one policy key per " +
-               "holder. Silence is refused, and one holder's certificate can never authorise " +
-               "a spend of another holder's output.",
+    statement: "The engine COMPUTES the digest it signs; it never accepts one. It derives " +
+               "the BIP-341 sighash from the transaction it was shown, over the prevout it " +
+               "verified is governed by this holder's own anchored commitment. A request " +
+               "carrying `spendDigest` is refused outright, and one holder's certificate " +
+               "cannot obtain a signature over another holder's coin.",
     proof: () => {
-      // Bound to the output this holder's commitment actually governs: authorises, and the
-      // receipt SAYS it is bound.
-      const anchoredFactHash = authorizeAndSign(goodReq()).evidence.anchoredFactHash;
-      const spk = policyOutputScriptPubKey(anchoredFactHash, schnorr.getPublicKey(POLICY_KEY));
-      const r = authorizeAndSign({ ...goodReq(), spendContext: { prevoutScriptPubKey: spk } });
-      return r.authorized === true && r.evidence.outputBound === true;
+      // The engine computes the digest. The holder signs THAT SAME digest, because the
+      // custodian's helper told them what it would be — neither party chose it.
+      const r = authorizeAndSign(goodReq());
+      return r.authorized === true && r.evidence.outputBound === true &&
+             r.evidence.digestSigned === toHexLocal(SC.digest);
     },
     attack: () => {
-      // 1. Silence must NOT be the permissive default. This is the whole finding: round 7
-      //    had one legitimate client of a custodian buy a signature over another client's
-      //    sighash precisely because omitting the binding authorised anyway.
-      const { singlePolicyKeyPerHolder: _drop, ...silent } = goodReq();
+      // 1. A supplied digest must be refused OUTRIGHT. This is the whole of round 8: an
+      //    engine that accepts a digest is an oracle, and every check it then performs
+      //    compares two values the caller controls.
+      const withDigest = authorizeAndSign({ ...goodReq(), spendDigest: new Uint8Array(32) });
+      if (withDigest.authorized !== false || withDigest.reason !== REFUSED.MALFORMED_REQUEST) return false;
+
+      // 2. No spendContext at all: refused. Silence is not a safe default.
+      const { spendContext: _drop, ...silent } = goodReq();
       const q = authorizeAndSign(silent);
       if (q.authorized !== false || q.policySignatureHex !== null) return false;
-      // 2. A DIFFERENT holder's output must be refused, not signed.
-      const other = "11".repeat(32);
-      const foreign = policyOutputScriptPubKey(other, schnorr.getPublicKey(POLICY_KEY));
-      const r = authorizeAndSign({ ...goodReq(), spendContext: { prevoutScriptPubKey: foreign } });
-      if (r.authorized !== false || r.policySignatureHex !== null) return false;
-      // 3. A malformed binding must refuse rather than fall back to the unbound path.
-      const bad = authorizeAndSign({ ...goodReq(), spendContext: { prevoutScriptPubKey: "00" } });
-      if (bad.authorized !== false) return false;
-      // 4. The asserted single-key mode still works, and the receipt does not claim binding.
-      const a = authorizeAndSign(goodReq());
-      return a.authorized === true && a.evidence.outputBound === false;
+
+      // 3. ANOTHER HOLDER'S COIN. The prevout at inputIndex is a real P2TR output governed
+      //    by a DIFFERENT fact hash. Round 8 obtained a signature over exactly this; it must
+      //    now be impossible, because the output key no longer derives from this certificate.
+      const foreign = buildSpendContext({
+        anchoredFactHash: "22".repeat(32), policyPublicKey: schnorr.getPublicKey(POLICY_KEY),
+        txid: "33".repeat(32), valueSats: 100_000n,
+        outputs: [{ valueSats: 90_000n, scriptPubKey: new Uint8Array(34) }],
+      });
+      const cross = authorizeAndSign({ ...goodReq(), spendContext: foreign.spendContext });
+      if (cross.authorized !== false || cross.reason !== REFUSED.OUTPUT_NOT_BOUND) return false;
+
+      // 4. And the signature must be over the digest WE computed — never over one that
+      //    happens to be lying around. Swapping the transaction changes the digest, so the
+      //    holder's ML-DSA authorisation no longer matches and the spend is refused.
+      const other = buildSpendContext({
+        anchoredFactHash: ANCHORED_FH, policyPublicKey: schnorr.getPublicKey(POLICY_KEY),
+        txid: "44".repeat(32), valueSats: 100_000n,
+        outputs: [{ valueSats: 80_000n, scriptPubKey: new Uint8Array(34) }],
+      });
+      if (toHexLocal(other.digest) === toHexLocal(SC.digest)) return false;   // must actually differ
+      const mismatched = authorizeAndSign({ ...goodReq(), spendContext: other.spendContext });
+      return mismatched.authorized === false;
+    },
+    note: "Round 8's critical, and the second attempt at it. Round 7 compared a presented " +
+          "scriptPubKey against one recomputed from the requester's fact hash — and round 8 " +
+          "walked through it, because BOTH SIDES OF THAT COMPARISON WERE THE REQUESTER'S: a " +
+          "second legitimate client presented its OWN output alongside the VICTIM's sighash " +
+          "and the policy key signed a complete witness for someone else's coin. The law we " +
+          "had not applied: NEVER SIGN A DIGEST YOU DID NOT COMPUTE YOURSELF. The caller now " +
+          "supplies the transaction; the engine derives the BIP-341 sighash over the prevout " +
+          "it verified belongs to this holder. `spendDigest` is refused outright, and with it " +
+          "the entire TOCTOU class that `snapshot32` existed to guard — removing an input is " +
+          "stronger than watching it. The round-7 residual this note used to declare — that " +
+          "the engine did not recompute the BIP-341 sighash — is CLOSED: it recomputes it now, " +
+          "and that is the whole fix.",
+  },
+  {
+    id: "R9-holder-can-reproduce-any-digest",
+    module: "policy.mjs",
+    statement: "For every transaction this engine will authorise, the holder can derive the " +
+               "exact digest themselves with the helper we ship — including multi-input " +
+               "spends. A holder who cannot reproduce the digest is signing one the custodian " +
+               "computed, which is the mistake this engine stopped making in 0.9.0.",
+    proof: () => {
+      // Multi-input: the engine accepts these, so the helper must build them.
+      const foreignSpk = policyOutputScriptPubKey("22".repeat(32), schnorr.getPublicKey(POLICY_KEY));
+      const multi = buildSpendContext({
+        anchoredFactHash: ANCHORED_FH, policyPublicKey: schnorr.getPublicKey(POLICY_KEY),
+        txid: "11".repeat(32), valueSats: 100_000n,
+        outputs: [{ valueSats: 90_000n, scriptPubKey: new Uint8Array(34) }],
+        otherInputs: [{ txid: "99".repeat(32), vout: 1, valueSats: 50_000n, scriptPubKey: foreignSpk }],
+      });
+      if (multi.spendContext.tx.inputs.length !== 2) return false;
+      // The holder SEES the other coin and the destinations before signing.
+      if (multi.inspect.alsoSpends.length !== 1) return false;
+      if (!Array.isArray(multi.inspect.paysOut) || multi.inspect.paysOut.length !== 1) return false;
+      const r = authorizeAndSign({ ...goodReq(), spendContext: multi.spendContext,
+        pqSignatureHex: authorizeSpend(ident, multi.digest) });
+      // The digest the engine signed is EXACTLY the one the holder derived.
+      return r.authorized === true && r.evidence.digestSigned === toHexLocal(multi.digest);
+    },
+    attack: () => {
+      // A single-input helper cannot reproduce a two-input digest: if it ever silently
+      // returned one anyway, the holder would be signing blind and this must fail.
+      const foreignSpk = policyOutputScriptPubKey("22".repeat(32), schnorr.getPublicKey(POLICY_KEY));
+      const one = buildSpendContext({ anchoredFactHash: ANCHORED_FH,
+        policyPublicKey: schnorr.getPublicKey(POLICY_KEY), txid: "11".repeat(32), valueSats: 100_000n,
+        outputs: [{ valueSats: 90_000n, scriptPubKey: new Uint8Array(34) }] });
+      const two = buildSpendContext({ anchoredFactHash: ANCHORED_FH,
+        policyPublicKey: schnorr.getPublicKey(POLICY_KEY), txid: "11".repeat(32), valueSats: 100_000n,
+        outputs: [{ valueSats: 90_000n, scriptPubKey: new Uint8Array(34) }],
+        otherInputs: [{ txid: "99".repeat(32), vout: 1, valueSats: 50_000n, scriptPubKey: foreignSpk }] });
+      // Different transactions MUST produce different digests, or the sighash is broken.
+      if (toHexLocal(one.digest) === toHexLocal(two.digest)) return false;
+      // And the ML-DSA authorisation for one must not authorise the other.
+      const wrong = authorizeAndSign({ ...goodReq(), spendContext: two.spendContext,
+        pqSignatureHex: authorizeSpend(ident, one.digest) });
+      return wrong.authorized === false;
+    },
+    note: "Round 9's blind spot, and nobody had looked at the holder's side in nine rounds. " +
+          "The engine stopped accepting digests; the helper still built only single-input " +
+          "transactions, so for a multi-input spend the holder had to sign whatever the " +
+          "custodian handed them. `inspect` also exists now because a digest you cannot read " +
+          "is a digest you cannot refuse: it names the other coins and every destination, " +
+          "with the warning that this engine constrains WHOSE coin is spent and never WHERE " +
+          "the value goes.",
+  },
+  {
+    id: "R10-every-caller-field-read-once",
+    module: "policy.mjs",
+    statement: "cutoffBlockHeight, blockMerkleRoots and knownHeads are each read from the " +
+               "request exactly once: an accessor that shows one value to a validation guard " +
+               "and a different one to the call that actually gates authorisation is refused " +
+               "outright, never read twice.",
+    proof: () => {
+      // Baseline still authorises with the fields supplied plainly — the guard must not
+      // reject an honest, non-accessor request.
+      return authorizeAndSign(goodReq()).authorized === true;
+    },
+    attack: () => {
+      // 1. knownHeads: a getter shows a genuinely conflicting head to the Array.isArray/.length
+      //    guard, then an EMPTY array to the for...of that runs detectEquivocation. Before this
+      //    round, the loop skipped split-view detection entirely and the engine signed.
+      const evilSth = T.signTreeHead({ secretKey: kp.secretKey, publicKey: kp.publicKey,
+        treeSize: STH.treeSize, rootHash: T.merkleRoot(leaves(9)), timestampMs: STH.timestampMs });
+      const req1 = goodReq();
+      let reads1 = 0;
+      Object.defineProperty(req1, "knownHeads",
+        { get() { reads1++; return reads1 <= 2 ? [evilSth] : []; } });
+      const r1 = authorizeAndSign(req1);
+      if (r1.authorized !== false) return false;
+
+      // 2. cutoffBlockHeight: a getter shows a strict height (700,000) to the shape/absence
+      //    guards and a laxer one (950,000) to certIsFirstSeen, which is the read that
+      //    actually decides whether the anchor is "before" the cutoff.
+      const req2 = goodReq();
+      let reads2 = 0;
+      Object.defineProperty(req2, "cutoffBlockHeight",
+        { get() { reads2++; return reads2 <= 2 ? 700_000 : 950_000; } });
+      const r2 = authorizeAndSign(req2);
+      if (r2.authorized !== false) return false;
+
+      // 3. blockMerkleRoots: a getter swaps the entire roots object between the shape guard
+      //    and the calls inside proveExposureRelativePrimacy/certIsFirstSeen that actually
+      //    index into it by height.
+      const req3 = goodReq();
+      let reads3 = 0;
+      const honestRoots = HEADERS;
+      const poisonedRoots = { [CUTOFF - 1]: REAL_ROOT };
+      Object.defineProperty(req3, "blockMerkleRoots",
+        { get() { reads3++; return reads3 <= 1 ? honestRoots : poisonedRoots; } });
+      const r3 = authorizeAndSign(req3);
+      if (r3.authorized !== false) return false;
+
+      // And the accessor guard must never fire on a plain, non-accessor value — refusing an
+      // honest request would be a false positive as serious as missing the real one.
+      return authorizeAndSign(goodReq()).authorized === true;
     },
-    note: "Round 7's critical. `spendDigest` is 32 opaque bytes chosen by the requester; " +
-          "before this, the receipt named the HOLDER while the coin could be anyone's. " +
-          "RESIDUAL, stated rather than hidden: the engine checks that the scriptPubKey is " +
-          "the one this commitment governs, but does not recompute the BIP-341 sighash from " +
-          "the transaction — the caller must derive the digest from the prevout it presents.",
+    note: "Round 10 (this audit): the discipline `anchorEvidence` already had — refuse an " +
+          "accessor-backed carrier, snapshot ONCE, read nothing but the snapshot — had not " +
+          "been extended to cutoffBlockHeight, blockMerkleRoots or knownHeads. For knownHeads " +
+          "and cutoffBlockHeight the exploit was demonstrated to completion and is mutation-" +
+          "killable: a real ML-DSA-gated Schnorr signature came out in exactly the case " +
+          "`limitFour_historyNotPinned` promises a refusal for. blockMerkleRoots got the same " +
+          "fix on the same reasoning, but HONESTLY: no mutation for it is registered in " +
+          "mutations.mjs, because every consumer looks the anchor height up BY KEY, so a " +
+          "divergent read fails CLOSED (a missing/mismatched height refuses) rather than open " +
+          "— we could not construct an attack that flips authorisation via this field alone. " +
+          "It is defense-in-depth applied by analogy, not the closure of a demonstrated bypass, " +
+          "and mutations.mjs says so rather than shipping a mutation that always reads " +
+          "'detected: false'.",
   },
   {
     id: "R7-no-claim-without-the-proof-that-earns-it",
@@ -578,13 +728,27 @@ export const UNCLAIMED_GUARDS = Object.freeze([
          "blocks) — again stronger than a claim, again not in the ledger" },
   { where: "policy.mjs", guard: "the ORDER of the refusal guards",
     why: "each guard is claimed individually; nothing claims that reordering them is safe" },
-  { where: "policy.mjs", guard: "WHICH OUTPUT is being spent — unless spendContext is supplied",
-    why: "the engine reads a 32-byte spendDigest chosen by the requester. WITHOUT " +
-         "`spendContext.prevoutScriptPubKey` the receipt identifies the HOLDER, never the " +
-         "COIN: it records who was authorised to make the policy key sign SOMETHING. Round 7 " +
-         "used exactly this to have one legitimate client of a custodian buy a signature over " +
-         "another client's sighash. Supply spendContext (enforced when present) or use ONE " +
-         "POLICY KEY PER HOLDER, without exception" },
+  { where: "policy.mjs", guard: "buildSpendContext is single-input; the engine is not",
+    why: "ROUND 9. The helper we ship — the only one the package documents so that 'the holder " +
+         "signs what the custodian will sign' — hardcodes one input and inputIndex 0, while " +
+         "authorizeAndSign accepts and authorises multi-input transactions. For those the " +
+         "holder cannot reproduce the digest with anything we gave them, so they must sign one " +
+         "the custodian computed. Measured: engine authorises the 2-input tx, the other input " +
+         "is not named in the receipt, and the holder's helper-derived digest differs from the " +
+         "one signed. The oracle moved rather than vanished, and until the helper covers the " +
+         "multi-input case this is the honest boundary" },
+  { where: "policy.mjs", guard: "WHERE THE MONEY GOES — the engine imposes nothing on the outputs",
+    why: "the engine verifies the coin being SPENT belongs to this holder, and computes the " +
+         "sighash itself, so no one can be made to sign for someone else's coin. It says " +
+         "NOTHING about the destinations. A custodian that constructs the transaction can " +
+         "route the whole balance to itself, and the engine authorises: verified by our own " +
+         "test on 2026-08-31 (control pays the holder -> authorized; the SAME coin paying a " +
+         "thief -> authorized). The holder's ML-DSA signature is the only thing standing " +
+         "between them and that, so THE HOLDER MUST INSPECT THE TRANSACTION, not just sign " +
+         "the digest the custodian hands them. The receipt does not name the outputs either. " +
+         "This is the honest boundary of what a policy engine can do: it can prove WHOSE coin " +
+         "and WHO authorised, never WHERE it should go — that is the holder's job, and we " +
+         "must not let the digest-signing flow imply otherwise" },
   { where: "policy.mjs / primacy.mjs", guard: "prose-to-code agreement",
     why: "the ledger governs CODE -> CLAIM (kill the code and the claim dies). NOTHING " +
          "governs PROSE -> CODE. Every one of round 7's findings landed in that hole, " +