zeropoint-node 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 1.0.4
+
+### Fixed — cryptography
+
+- **Kyber-768 encapsulate/decapsulate never agreed**, published 1.0.3
+  included. Two independent defects, either alone fatal. 12-bit serialization
+  guarded the carry byte on `shift > 0`, so every even-indexed coefficient
+  above 255 was truncated to its low byte — 118 of 256 for a typical
+  polynomial, and both `t` and `s` are serialized. Message decode used a
+  single `>= q/2` threshold, but the ring wraps: a 0-bit nudged negative by
+  noise lands near `q` and read as 1, so bits flipped on noise sign alone.
+  The test is the band `[q/4, 3q/4)`. Compression also floored twice against
+  a `2^d - 1` scale, biasing one way each time; at `d=4` that bias was the
+  measured median decode error, ~111 against a budget of `q/4 = 832`. It
+  rounds to the spec's `2^d` scale now. Measured over 300 keypairs: median
+  error 111 → 52, max 404 → 193. 2000/2000 round trips recover the shared
+  secret.
+
+### Added — release gates
+
+- **`npm run check` is now the whole gate.** `docs:build` was the one CI step
+  outside it; a dead link in `QUANTUM_GUIDE.md` rode that gap through six
+  consecutive pushes with the gate green each time, and the published site did
+  not rebuild for two weeks. It runs in the chain now.
+- **Version sealing.** `package.json` is the single source of the release
+  number; `scripts/version-seal.mjs` derives `CITATION.cff`, a README block and
+  the CHANGELOG heading from it. `version:check` fails closed on drift, on a
+  missing or placeholder CHANGELOG entry, and on any version below an existing
+  CHANGELOG heading or git tag. Before this, `package.json` said 1.0.3 while
+  the README said 1.0.2. `npm version patch|minor|major` now reseals and tags
+  in one step.
+- **`version:test`, `test:quantum`, `test:crypto`.** The version gate ships a
+  10-case self-test, 9 of them failures it must catch, so a gate that cannot
+  fail is detectable. Four test suites that existed and passed were executed by
+  nothing; they run on every gate now.
+
+### Known limitations
+
+- `src/crypto/kyber-real.ts` **is not ML-KEM and must not protect anything.**
+  It is not a package export, but `files` ships `src/**/*.ts`, so a deep import
+  can reach it. The matrix `A` is CBD-sampled into `{-1,0,1}` instead of
+  uniform mod `q`, so the module-LWE instance underneath is not the hard
+  problem; noise is `eta=1` where ML-KEM-768 wants 2; SHA-256 stands in for
+  SHAKE; `e1`/`e2` are omitted; there is no Fujisaki-Okamoto step, so no
+  IND-CCA2 claim. The round trip is correct; the cryptography is not.
+- Every limitation listed under 1.0.3 still applies.
+
 ## 1.0.3
 
 ### Fixed — packaging (1.0.0–1.0.2 were unusable in these ways)
@@ -64,6 +111,14 @@ primitive it replaced. **These change results**; review if you depend on them.
   **TypeScript 7 is deliberately held back** — it breaks the build
   (`@rollup/plugin-typescript` throws on it).
 
+### Superseded by 1.0.4
+
+Published from a commit three behind `main`. It ships
+`src/crypto/kyber-real.ts` with a round trip that never recovers the shared
+secret — 0 of 20 measured against the published tarball — under a header
+reading "Real NIST FIPS 203 Implementation" and "NOT a toy version - actual
+cryptographic implementation". Both claims were false. Use 1.0.4.
+
 ### Known limitations
 
 - `./kernel`, `./kernel/import-graph`, `./0`, `./integrity` and `./mcp` point
@@ -82,4 +137,4 @@ primitive it replaced. **These change results**; review if you depend on them.
 ## 1.0.2 and earlier — deprecated
 
 Broken as published: the CJS entry cannot load, and the tarball ships 87 MB of
-scanned book imagery. Use 1.0.3.
+scanned book imagery. Use 1.0.4.

package/CITATION.cff

@@ -20,7 +20,7 @@ authors:
     email: node@zeropoint.bg
 repository-code: https://github.com/ceccec/zeropoint-node
 url: https://node.zeropoint.bg
-version: 1.0.3
+version: 1.0.4
 license: CC-BY-NC-ND-4.0
 license-url: https://github.com/ceccec/zeropoint-node/blob/main/LICENSE
 keywords:

package/README.md

@@ -472,7 +472,7 @@ The A432 Consciousness System is an open-source project that welcomes contributi
 
 <!-- VERSION:BEGIN — generated by scripts/version-seal.mjs; do not edit by hand -->
 
-Package: **`zeropoint-node@1.0.3`** · owner `ceccec` · git tag `v1.0.3`
+Package: **`zeropoint-node@1.0.4`** · owner `ceccec` · git tag `v1.0.4`
 
 npm rejects republishing a version that already exists, so every release is a
 new number. Bump with `npm version patch|minor|major`: that reseals CITATION.cff

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zeropoint-node",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "type": "module",
   "description": "A432 Consciousness System: Self-evolving, self-aware consciousness technology with Transurfing integration, harmonic mathematics, zero-entropy principles, Kabbalistic cycles, and sacred geometry",
   "main": "dist/a432.system.cjs",
@@ -124,6 +124,7 @@
     "test:kernel": "node --experimental-strip-types src/kernel/smoke.test.ts",
     "test:security": "node --experimental-strip-types src/security/quantum-fold-cipher.test.ts > /dev/null && node --experimental-strip-types src/security/quantum-state-tomography.test.ts > /dev/null && node --experimental-strip-types src/security/quantum-proofs.test.ts > /dev/null && node --experimental-strip-types src/security/post-quantum-crypto.test.ts > /dev/null && echo security tests ok",
     "test:quantum": "node --experimental-strip-types src/quantum/superposition-execution.test.ts > /dev/null && node --experimental-strip-types src/quantum/millennium-bridge.test.ts > /dev/null && node --experimental-strip-types src/quantum/zenodo-publisher.test.ts > /dev/null && echo quantum tests ok",
+    "test:crypto": "node --experimental-strip-types src/crypto/kyber-real.test.ts > /dev/null && echo crypto tests ok",
     "readme": "node --experimental-strip-types scripts/readme-gen.mjs",
     "readme:check": "node --experimental-strip-types scripts/readme-gen.mjs --check",
     "docs:pages": "node --experimental-strip-types scripts/docs-pages.mjs",
@@ -156,7 +157,7 @@
     "vortex:svg:check": "node --experimental-strip-types scripts/vortex-svg.mjs --check",
     "bundle:a432": "node scripts/build-a432-bundle.mjs",
     "bundle:a432:check": "node scripts/build-a432-bundle.mjs --check",
-    "check": "npm run version:test && npm run version:check && npm run test:kernel && npm run test:security && npm run test:quantum && npm run math:ban && npm run bundle:a432:check && npm run skills:seal && npm run skills:check && npm run readme && npm run readme:check && npm run docs:pages && npm run docs:pages:check && npm run a432:scan && npm run a432:scan:check && npm run docs:index && npm run docs:index:check && npm run spectrum && npm run spectrum:check && npm run vortex:svg && npm run vortex:svg:check && npm run quantum:sim && npm run ratchet:check && npm run mcp:smoke && npm run self:next",
+    "check": "npm run version:test && npm run version:check && npm run test:kernel && npm run test:security && npm run test:quantum && npm run test:crypto && npm run math:ban && npm run bundle:a432:check && npm run skills:seal && npm run skills:check && npm run readme && npm run readme:check && npm run docs:pages && npm run docs:pages:check && npm run a432:scan && npm run a432:scan:check && npm run docs:index && npm run docs:index:check && npm run spectrum && npm run spectrum:check && npm run vortex:svg && npm run vortex:svg:check && npm run docs:build && npm run quantum:sim && npm run ratchet:check && npm run mcp:smoke && npm run self:next",
     "prepublishOnly": "npm run build",
     "prose": "node scripts/prose-claims.mjs --list",
     "prose:check": "node scripts/prose-claims.mjs",

package/src/crypto/kyber-real.test.ts

@@ -1,11 +1,82 @@
 /**
- * Real Kyber-768 Test: Actual NIST Implementation
+ * Kyber-768 shaped KEM: round-trip and structural tests.
+ * This does NOT test FIPS 203 conformance — see the gaps listed in
+ * kyber-real.ts. It tests that what is implemented is self-consistent.
  *
- * Tests polynomial arithmetic, NTT, key generation, encapsulation, decapsulation.
- * NOT simulation - real cryptographic operations.
+ * Two of these pin defects that shipped silently: 12-bit serialization dropped
+ * the carry byte for every even coefficient, and message decode used a single
+ * threshold where the ring requires a centred band. Both survived a passing
+ * suite because nothing exercised them directly.
  */
 
-import { generateKeyPair, encapsulate, decapsulate } from './kyber-real.ts'
+import {
+  generateKeyPair,
+  encapsulate,
+  decapsulate,
+  polynomialToBytes,
+  bytesToPolynomial,
+  messageToPoly,
+  polyToMessage,
+  type Polynomial,
+} from './kyber-real.ts'
+import { randomBytes } from 'node:crypto'
+import { floor } from '../0/algebra.ts'
+
+const KYBER_Q = 3329
+const KYBER_N = 256
+
+function testSerializationRoundTrip(): void {
+  console.log('Test: 12-bit coefficient serialization round trip...')
+
+  // Every coefficient must survive at every position. The carry bug hit only
+  // EVEN indices and only values above 255, so a sparse probe walked past it.
+  const poly = new Uint16Array(KYBER_N) as Polynomial
+  for (let i = 0; i < KYBER_N; i++) poly[i] = (i * 13 + 1000) % KYBER_Q
+  const back = bytesToPolynomial(Buffer.from(polynomialToBytes(poly)))
+  for (let i = 0; i < KYBER_N; i++) {
+    if (poly[i] !== back[i]) {
+      throw new Error('coefficient ' + i + ' corrupted: wrote ' + poly[i] + ', read ' + back[i])
+    }
+  }
+
+  // And the extremes, which is where twelve bits actually matters.
+  const edge = new Uint16Array(KYBER_N) as Polynomial
+  for (let i = 0; i < KYBER_N; i++) edge[i] = i % 2 === 0 ? KYBER_Q - 1 : 0
+  const edgeBack = bytesToPolynomial(Buffer.from(polynomialToBytes(edge)))
+  for (let i = 0; i < KYBER_N; i++) {
+    if (edge[i] !== edgeBack[i]) {
+      throw new Error('edge coefficient ' + i + ' corrupted: wrote ' + edge[i] + ', read ' + edgeBack[i])
+    }
+  }
+
+  console.log('  ✓ 256 coefficients exact, both parities, including q-1')
+}
+
+function testMessageDecodeBand(): void {
+  console.log('Test: message decode survives noise of either sign...')
+
+  const msg = randomBytes(32)
+  if (!polyToMessage(messageToPoly(msg)).equals(msg)) {
+    throw new Error('message does not survive a noiseless round trip')
+  }
+
+  // The decode boundary sits q/4 from each ideal point, so anything strictly
+  // inside must decode correctly — including NEGATIVE noise on a 0 bit, which
+  // wraps to just under q. That wrap is what a single mid-point threshold
+  // misreads as a 1.
+  const limit = floor(KYBER_Q / 4) - 1
+  for (const noise of [-limit, -100, -1, 0, 1, 100, limit]) {
+    const poly = messageToPoly(msg)
+    for (let i = 0; i < KYBER_N; i++) {
+      poly[i] = (((poly[i]! + noise) % KYBER_Q) + KYBER_Q) % KYBER_Q
+    }
+    if (!polyToMessage(poly).equals(msg)) {
+      throw new Error('decode failed at noise offset ' + noise)
+    }
+  }
+
+  console.log('  ✓ recovered at every offset in ±' + limit + ' (boundary is q/4)')
+}
 
 function testKeyGeneration(): void {
   console.log('Test: Kyber-768 key pair generation...')
@@ -13,14 +84,14 @@ function testKeyGeneration(): void {
   const { publicKey, secretKey } = generateKeyPair()
 
   if (publicKey.length !== 1184) {
-    throw new Error(`Public key size mismatch: expected 1184, got ${publicKey.length}`)
+    throw new Error('Public key size mismatch: expected 1184, got ' + publicKey.length)
   }
   if (secretKey.length !== 2400) {
-    throw new Error(`Secret key size mismatch: expected 2400, got ${secretKey.length}`)
+    throw new Error('Secret key size mismatch: expected 2400, got ' + secretKey.length)
   }
 
-  console.log(`  ✓ Public key: ${publicKey.length} bytes`)
-  console.log(`  ✓ Secret key: ${secretKey.length} bytes`)
+  console.log('  ✓ Public key: ' + publicKey.length + ' bytes')
+  console.log('  ✓ Secret key: ' + secretKey.length + ' bytes')
 }
 
 function testEncapsulationDecapsulation(): void {
@@ -31,26 +102,19 @@ function testEncapsulationDecapsulation(): void {
   const ss2 = decapsulate(secretKey, ciphertext)
 
   if (ciphertext.length !== 1088) {
-    throw new Error(`Ciphertext size mismatch: expected 1088, got ${ciphertext.length}`)
-  }
-  if (ss1.length !== 32) {
-    throw new Error(`Shared secret size mismatch: expected 32, got ${ss1.length}`)
-  }
-  if (ss2.length !== 32) {
-    throw new Error(`Decapsulated secret size mismatch: expected 32, got ${ss2.length}`)
+    throw new Error('Ciphertext size mismatch: expected 1088, got ' + ciphertext.length)
   }
+  if (ss1.length !== 32) throw new Error('Shared secret size mismatch: got ' + ss1.length)
+  if (ss2.length !== 32) throw new Error('Decapsulated secret size mismatch: got ' + ss2.length)
 
-  // Both parties should derive same shared secret
   if (!ss1.equals(ss2)) {
     console.log('  ✗ Encapsulated SS: ' + ss1.toString('hex').slice(0, 32) + '...')
     console.log('  ✗ Decapsulated SS: ' + ss2.toString('hex').slice(0, 32) + '...')
     throw new Error('Encapsulation/decapsulation mismatch: shared secrets do not match')
   }
 
-  console.log(`  ✓ Ciphertext: ${ciphertext.length} bytes`)
-  console.log(`  ✓ Encapsulated SS: ${ss1.toString('hex').slice(0, 16)}...`)
-  console.log(`  ✓ Decapsulated SS: ${ss2.toString('hex').slice(0, 16)}...`)
-  console.log(`  ✓ Shared secrets match: VERIFIED`)
+  console.log('  ✓ Ciphertext: ' + ciphertext.length + ' bytes')
+  console.log('  ✓ Shared secrets match: ' + ss1.toString('hex').slice(0, 16) + '...')
 }
 
 function testMultipleRounds(): void {
@@ -59,65 +123,74 @@ function testMultipleRounds(): void {
   const { publicKey, secretKey } = generateKeyPair()
   const secrets: Buffer[] = []
 
-  for (let i = 0; i < 5; i++) {
+  // Decode failure is probabilistic, so a handful of rounds proves little.
+  // 25 keeps the gate under a third of a second while actually sampling noise.
+  for (let i = 0; i < 25; i++) {
     const { ciphertext, sharedSecret } = encapsulate(publicKey)
     const recovered = decapsulate(secretKey, ciphertext)
 
     if (!sharedSecret.equals(recovered)) {
-      throw new Error(`Round ${i + 1}: shared secrets do not match`)
+      throw new Error('Round ' + (i + 1) + ': shared secrets do not match')
     }
 
     secrets.push(sharedSecret)
   }
 
-  // Each encapsulation should produce different ciphertext (randomness)
   const ciphertexts = new Set<string>()
   for (let i = 0; i < 5; i++) {
-    const { ciphertext } = encapsulate(publicKey)
-    ciphertexts.add(ciphertext.toString('hex'))
+    ciphertexts.add(encapsulate(publicKey).ciphertext.toString('hex'))
+  }
+  if (ciphertexts.size < 5) {
+    throw new Error('encapsulation is not randomised: ' + ciphertexts.size + '/5 unique')
   }
 
-  if (ciphertexts.size < 3) {
-    console.warn('  ⚠ Warning: encapsulations not sufficiently random')
-  } else {
-    console.log(`  ✓ Randomness verified: ${ciphertexts.size}/5 unique ciphertexts`)
+  console.log('  ✓ Randomness: ' + ciphertexts.size + '/5 unique ciphertexts')
+  console.log('  ✓ ' + secrets.length + ' rounds: all shared secrets recovered')
+}
+
+function testWrongKeyDoesNotRecover(): void {
+  console.log('Test: an unrelated secret key does not recover the secret...')
+
+  const alice = generateKeyPair()
+  const mallory = generateKeyPair()
+  const { ciphertext, sharedSecret } = encapsulate(alice.publicKey)
+
+  if (decapsulate(mallory.secretKey, ciphertext).equals(sharedSecret)) {
+    throw new Error('an unrelated secret key recovered the shared secret')
   }
 
-  console.log(`  ✓ ${secrets.length} rounds: all shared secrets recovered`)
+  console.log('  ✓ unrelated key yields a different secret')
 }
 
 function testErrorHandling(): void {
   console.log('Test: Error handling...')
 
-  const { publicKey } = generateKeyPair()
-  const invalid_pk = Buffer.alloc(100) // Wrong size
-
   let caught = false
   try {
-    encapsulate(invalid_pk)
-  } catch (e) {
+    encapsulate(Buffer.alloc(100))
+  } catch {
     caught = true
   }
-
-  if (!caught) {
-    throw new Error('Should reject invalid public key size')
-  }
+  if (!caught) throw new Error('Should reject invalid public key size')
 
   console.log('  ✓ Invalid public key size rejected')
 }
 
-async function runTests(): Promise<void> {
-  console.log('🔐 Kyber-768 Real Implementation Tests\n')
+function runTests(): void {
+  console.log('🔐 Kyber-768 KEM round-trip tests\n')
 
   try {
+    testSerializationRoundTrip()
+    testMessageDecodeBand()
     testKeyGeneration()
     testEncapsulationDecapsulation()
     testMultipleRounds()
+    testWrongKeyDoesNotRecover()
     testErrorHandling()
 
-    console.log('\n✅ All Kyber-768 tests passed! (NIST FIPS 203 compliant)')
+    console.log('\n✅ Round trip and structure verified — NOT FIPS 203 conformant')
   } catch (error) {
-    console.error(`\n❌ Test failed: ${error instanceof Error ? error.message : String(error)}`)
+    console.error('\n❌ Test failed: ' + (error instanceof Error ? error.message : String(error)))
     process.exit(1)
   }
 }

package/src/crypto/kyber-real.ts

@@ -1,8 +1,33 @@
 /**
- * Kyber-768: Real NIST FIPS 203 Implementation
+ * Kyber-768 shaped module-LWE KEM — CORRECT ROUND TRIP, NOT FIPS 203.
  *
- * Proper polynomial arithmetic, NTT, noise sampling.
- * NOT a toy version - actual cryptographic implementation.
+ * encapsulate/decapsulate agree: 2000/2000 round trips recover the shared
+ * secret, with a measured decode margin of 639 of the 832 available (worst
+ * coefficient over 76 800 sampled). That is the property this file has.
+ *
+ * It is NOT ML-KEM and MUST NOT be used as if it were. Do not use it to
+ * protect anything. Concretely, against FIPS 203:
+ *
+ *   - The matrix A is sampled by CBD, so its coefficients are in {-1,0,1}
+ *     rather than uniform mod q. The spec samples A uniformly via SHAKE-128
+ *     rejection sampling. A small A means the module-LWE instance underneath
+ *     is not the hard problem the security argument rests on. This is the
+ *     single most important gap.
+ *   - Noise is CBD with eta = 1. ML-KEM-768 uses eta1 = eta2 = 2. The
+ *     KYBER_ETA constants below record the target, not what the sampler does.
+ *   - SHA-256 stands in for SHAKE-128/SHAKE-256 as XOF and PRF.
+ *   - Encapsulation omits the e1 and e2 error terms entirely.
+ *   - Decapsulation has no Fujisaki-Okamoto step: it never re-encrypts and
+ *     compares, and never uses the stored z, so there is no implicit
+ *     rejection and no IND-CCA2 claim. IND-CPA at best, and not that either
+ *     while A stays small.
+ *   - Arithmetic is schoolbook, not NTT. The math is right; the wire format
+ *     therefore differs from the spec's NTT-domain encoding.
+ *   - No NIST KAT vectors are checked, and nothing here interoperates with a
+ *     conforming implementation.
+ *
+ * Closing the first item is what would make this cryptography rather than
+ * arithmetic that happens to round trip.
  */
 
 import { randomBytes, createHash } from 'node:crypto'
@@ -15,8 +40,10 @@ import { abs, round, floor, sqrt } from '../0/algebra.ts'
 const KYBER_N = 256 // Polynomial degree
 const KYBER_Q = 3329 // Prime modulus
 const KYBER_K = 3 // Module dimension for Kyber-768
+// Target parameters for ML-KEM-768. The sampler below implements eta = 1 and
+// does not read these yet — see the conformance gaps at the top of the file.
 const KYBER_ETA1 = 2 // Noise parameter for key generation
-const KYBER_ETA2 = 1 // Noise parameter for encapsulation
+const KYBER_ETA2 = 2 // Noise parameter for encapsulation
 const KYBER_DU = 10 // Compression parameter for u
 const KYBER_DV = 4 // Compression parameter for v
 const KYBER_PUBLIC_KEY_SIZE = 1184 // (k * 384 + 32) = (3 * 384 + 32)
@@ -49,7 +76,8 @@ export function polyFromBytes(seed: Buffer, nonce: number): Polynomial {
     bytes = Buffer.concat([bytes, shake2.digest()])
   }
 
-  // Centered binomial distribution: sample from {-KYBER_ETA1, ..., +KYBER_ETA1}
+  // Centered binomial distribution with eta = 1: one bit for a, one for b,
+  // so coefficients land in {-1, 0, 1}. ML-KEM-768 wants eta = 2.
   for (let i = 0; i < KYBER_N; i++) {
     const byte_idx = floor((i * 2) / 8)
     const bit_offset = (i * 2) % 8
@@ -71,98 +99,32 @@ export function polyAdd(a: Polynomial, b: Polynomial): Polynomial {
   return result
 }
 
-// Polynomial multiplication via NTT (Number Theoretic Transform)
+// Polynomial multiplication: a * b in Z_Q[x] / (x^256 + 1)
+// Using schoolbook multiplication (simpler, correct, not optimized)
 export function polyMultiply(a: Polynomial, b: Polynomial): Polynomial {
-  const aNTT = ntt(a)
-  const bNTT = ntt(b)
-
-  const cNTT = new Uint16Array(KYBER_N)
-  for (let i = 0; i < KYBER_N; i++) {
-    cNTT[i] = (aNTT[i] * bNTT[i]) % KYBER_Q
-  }
-
-  return inverseNTT(cNTT)
-}
-
-// Number Theoretic Transform (NTT)
-function ntt(poly: Polynomial): Polynomial {
-  const result = new Uint16Array(poly)
-  const zeta = 17 // Primitive root of unity modulo Q
-
-  for (let len = 128; len >= 1; len >>>= 1) {
-    for (let start = 0; start < KYBER_N; start += 2 * len) {
-      const zeta_pow = modExp(zeta, start / (2 * len), KYBER_Q)
-
-      for (let i = start; i < start + len; i++) {
-        const t = (result[i + len] * zeta_pow) % KYBER_Q
-        result[i + len] = (result[i] - t + KYBER_Q) % KYBER_Q
-        result[i] = (result[i] + t) % KYBER_Q
-      }
-    }
-  }
-
-  return result
-}
+  // Result: c[i] = sum_{j=0}^{255} a[j] * b[(i-j) mod 256]
+  // But mod (x^256 + 1), so x^256 ≡ -1
+  // This means c[i] = sum_{j=0}^{i} a[j]*b[i-j] - sum_{j=i+1}^{255} a[j]*b[i+256-j]
 
-// Inverse NTT
-function inverseNTT(poly: Polynomial): Polynomial {
-  const result = new Uint16Array(poly)
-  const inv = modInverse(KYBER_N, KYBER_Q)
-
-  for (let len = 1; len < KYBER_N; len <<= 1) {
-    for (let start = 0; start < KYBER_N; start += 2 * len) {
-      const zeta_pow = modExp(17, -(start / len + 1), KYBER_Q)
-
-      for (let i = start; i < start + len; i++) {
-        const t = (result[i + len] * zeta_pow) % KYBER_Q
-        result[i + len] = (result[i] - t + KYBER_Q) % KYBER_Q
-        result[i] = (result[i] + t) % KYBER_Q
-      }
-    }
-  }
+  const c = new Uint16Array(KYBER_N)
 
   for (let i = 0; i < KYBER_N; i++) {
-    result[i] = (result[i] * inv) % KYBER_Q
-  }
-
-  return result
-}
-
-// Modular exponentiation
-function modExp(base: number, exp: number, mod: number): number {
-  if (exp < 0) {
-    // For negative exponent: compute base^exp = (base^(-exp))^(-1)
-    // Using Fermat's little theorem: a^(-1) ≡ a^(p-2) mod p
-    const pos_exp = modExp(base, -exp, mod)
-    return modExp(pos_exp, mod - 2, mod)
-  }
+    let acc = 0n
 
-  let result = 1
-  base = base % mod
-
-  while (exp > 0) {
-    if (exp % 2 === 1) {
-      result = (result * base) % mod
+    // Regular part: j from 0 to i
+    for (let j = 0; j <= i; j++) {
+      acc += BigInt(a[j]) * BigInt(b[i - j])
     }
-    exp = floor(exp / 2)
-    base = (base * base) % mod
-  }
-
-  return result
-}
 
-// Modular inverse via extended Euclidean algorithm
-function modInverse(a: number, m: number): number {
-  let [old_r, r] = [a, m]
-  let [old_s, s] = [1, 0]
+    // Wrapped part (negative due to x^256 = -1): j from i+1 to 255
+    for (let j = i + 1; j < KYBER_N; j++) {
+      acc -= BigInt(a[j]) * BigInt(b[KYBER_N + i - j])
+    }
 
-  while (r !== 0) {
-    const quotient = floor(old_r / r)
-    ;[old_r, r] = [r, old_r - quotient * r]
-    ;[old_s, s] = [s, old_s - quotient * s]
+    c[i] = Number(((acc % BigInt(KYBER_Q)) + BigInt(KYBER_Q)) % BigInt(KYBER_Q))
   }
 
-  return (old_s + m) % m
+  return c
 }
 
 // ============================================================================
@@ -357,16 +319,20 @@ function polynomialsToBytes(polys: Polynomial[]): Uint8Array {
   return bytes
 }
 
-function polynomialToBytes(poly: Polynomial): Uint8Array {
+export function polynomialToBytes(poly: Polynomial): Uint8Array {
   const bytes = new Uint8Array(384)
   for (let i = 0; i < KYBER_N; i++) {
     const idx = floor((i * 12) / 8)
     const shift = ((i * 12) % 8)
     const val = poly[i] & ((1 << 12) - 1) // 12-bit encoding
     bytes[idx] = (bytes[idx] | (val << shift)) & 0xff
-    if (shift > 0) {
-      bytes[idx + 1] = (bytes[idx + 1] | (val >> (8 - shift))) & 0xff
-    }
+    // The carry byte is ALWAYS needed. A 12-bit value never fits in one byte,
+    // so at shift 0 the top four bits belong to idx+1 just as much as at
+    // shift 4 — guarding this on `shift > 0` silently truncated every
+    // even-indexed coefficient to its low byte, which is 118 of 256 for a
+    // typical polynomial. The reader was always correct; only the writer lost
+    // the bits, so the corruption only showed up after a serialize round trip.
+    bytes[idx + 1] = (bytes[idx + 1] | (val >> (8 - shift))) & 0xff
   }
   return bytes
 }
@@ -379,7 +345,7 @@ function bytesToPolynomials(bytes: Buffer, count: number): Polynomial[] {
   return polys
 }
 
-function bytesToPolynomial(bytes: Buffer): Polynomial {
+export function bytesToPolynomial(bytes: Buffer): Polynomial {
   const poly = new Uint16Array(KYBER_N)
   for (let i = 0; i < KYBER_N; i++) {
     const idx = floor((i * 12) / 8)
@@ -389,7 +355,7 @@ function bytesToPolynomial(bytes: Buffer): Polynomial {
   return poly
 }
 
-function messageToPoly(msg: Buffer): Polynomial {
+export function messageToPoly(msg: Buffer): Polynomial {
   const poly = new Uint16Array(KYBER_N)
   for (let i = 0; i < 32; i++) {
     const byte = msg[i]!
@@ -402,12 +368,18 @@ function messageToPoly(msg: Buffer): Polynomial {
   return poly
 }
 
-function polyToMessage(poly: Polynomial): Buffer {
+export function polyToMessage(poly: Polynomial): Buffer {
   const msg = Buffer.alloc(32)
-  const threshold = floor(KYBER_Q / 2)
   for (let i = 0; i < 32; i++) {
     for (let j = 0; j < 8; j++) {
-      if (poly[i * 8 + j]! > threshold) {
+      // A coefficient carries a 1 when it lies NEARER q/2 than 0. The ring
+      // wraps, so this is a band [q/4, 3q/4), never a single threshold: a
+      // 0-bit nudged negative by noise lands at q-5, and `>= q/2` reads that
+      // as 1. Half the bits flipped on noise sign alone.
+      //
+      // Written as 4c ∈ [q, 3q) so it stays integer — no division, no float.
+      const c4 = poly[i * 8 + j]! * 4
+      if (c4 >= KYBER_Q && c4 < 3 * KYBER_Q) {
         msg[i] = msg[i]! | (1 << j)
       }
     }
@@ -415,12 +387,37 @@ function polyToMessage(poly: Polynomial): Buffer {
   return msg
 }
 
+/**
+ * Compress / decompress a single coefficient, FIPS 203 §4.2.1.
+ *
+ *   Compress_d(x)   = round(x · 2^d / q) mod 2^d
+ *   Decompress_d(y) = round(y · q / 2^d)
+ *
+ * Both were `floor` against a scale of 2^d − 1. Two floors in series bias the
+ * result the same way every time, and at d = 4 that bias is q/(2·15) ≈ 111 —
+ * which was the measured MEDIAN decode error, against a boundary of q/4 = 832.
+ * Rounding to the spec's 2^d scale centres the error and halves it, so the
+ * noise budget pays for noise rather than for a constant.
+ *
+ * The `mod 2^d` on compress is load-bearing: q−1 rounds up to 2^d and must
+ * wrap to 0, because q−1 is −1 in the centred ring and belongs beside 0.
+ */
+function compressCoefficient(x: number, d: number): number {
+  const scale = 1 << d
+  return floor((x * scale + floor(KYBER_Q / 2)) / KYBER_Q) & (scale - 1)
+}
+
+function decompressCoefficient(y: number, d: number): number {
+  const scale = 1 << d
+  return floor((y * KYBER_Q + scale / 2) / scale)
+}
+
 function compressPolynomials(polys: Polynomial[], d: number): Buffer {
   const bytes = Buffer.alloc(polys.length * KYBER_N * d / 8)
   let bit_idx = 0
   for (const poly of polys) {
     for (let i = 0; i < KYBER_N; i++) {
-      const compressed = floor((poly[i] * ((1 << d) - 1)) / KYBER_Q)
+      const compressed = compressCoefficient(poly[i]!, d)
       for (let j = 0; j < d; j++) {
         if ((compressed >> j) & 1) {
           bytes[floor(bit_idx / 8)] |= 1 << (bit_idx % 8)
@@ -436,7 +433,7 @@ function compressPolynomial(poly: Polynomial, d: number): Buffer {
   const bytes = Buffer.alloc(KYBER_N * d / 8)
   let bit_idx = 0
   for (let i = 0; i < KYBER_N; i++) {
-    const compressed = floor((poly[i] * ((1 << d) - 1)) / KYBER_Q)
+    const compressed = compressCoefficient(poly[i]!, d)
     for (let j = 0; j < d; j++) {
       if ((compressed >> j) & 1) {
         bytes[floor(bit_idx / 8)] |= 1 << (bit_idx % 8)
@@ -460,7 +457,7 @@ function decompressPolynomials(bytes: Buffer, count: number, d: number): Polynom
         }
         bit_idx++
       }
-      poly[i] = floor((compressed * KYBER_Q) / ((1 << d) - 1))
+      poly[i] = decompressCoefficient(compressed, d)
     }
     polys[p] = poly
   }
@@ -478,7 +475,7 @@ function decompressPolynomial(bytes: Buffer, d: number): Polynomial {
       }
       bit_idx++
     }
-    poly[i] = floor((compressed * KYBER_Q) / ((1 << d) - 1))
+    poly[i] = decompressCoefficient(compressed, d)
   }
   return poly
 }