zeropoint-node 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -1,5 +1,149 @@
 # Changelog
 
+## 1.0.5
+
+### Added — ML-KEM-768, actually conformant
+
+- **`src/crypto/ml-kem.ts` implements FIPS 203 ML-KEM-768 and is verified
+  against NIST's own vectors.** It replaces `src/crypto/kyber-real.ts`, which
+  is deleted. That module called itself Kyber and was not: it sampled the
+  matrix `A` from a centred binomial, so its coefficients lived in `{-1,0,1}`
+  instead of uniform over `Z_q`, and the module-LWE instance underneath was not
+  the hard problem. 1.0.4 fixed its round trip; a round trip only ever showed
+  the scheme agreed with itself.
+
+  What is here now: NTT twiddle factors computed from `ζ = 17` and a
+  bit-reversal rather than copied from a table; uniform `A` by rejection
+  sampling from SHAKE-128; CBD noise at `η₁ = η₂ = 2` from a SHAKE-256 PRF;
+  `ByteEncode`/`ByteDecode`, `Compress`/`Decompress` at `d_u = 10`, `d_v = 4`;
+  K-PKE wrapped in the Fujisaki–Okamoto transform with implicit rejection and a
+  full-length ciphertext comparison; and the §7.2 modulus check on
+  encapsulation keys.
+
+- **Conformance is recomputable, not asserted.** `npm run test:crypto` runs
+  NIST ACVP vectors for FIPS 203, ML-KEM-768 — 25 key generation, 25
+  encapsulation, 10 decapsulation including the implicit-rejection path, and 10
+  encapsulation-key validation cases. The vectors ship in the package as
+  `src/crypto/ml-kem-768-acvp.json`, so a consumer can re-run them.
+
+- **`npm run kat:ml-kem`** goes wider: 10 000 keygen/encaps/decaps triples from
+  a deterministic SHAKE-128 stream, accumulated into one digest that must equal
+  the value C2SP/CCTV publishes from the pq-crystals reference implementation.
+  It matches. Not in `npm run check` — it takes ~33s against a ~2 min gate.
+
+- The suite is mutation-tested: perturbing one twiddle factor, swapping the
+  matrix index order, changing `η₂`, truncating instead of rounding in
+  `Compress`, or dropping the modulus check each make it fail.
+
+### Fixed — quantum measurement and the Steane code
+
+Both found by writing seals that could fail, in `src/verification/lean-bridge.ts`.
+
+- **`measureQubit` was being handed a raw LCG state where it wants a unit in
+  `[0,1)`.** Its outcome test is `unit < 1 - pOne`, so any state of 1 or more
+  forced the result to 1. Four call sites did this: repetition-code syndrome
+  extraction and majority-vote decoding, `classifyMeasurement`, and all three
+  tomography bases. `measureZ` on `|0>` returned 999 ones in 1000 shots, and
+  syndrome extraction reported a clean codeword as error `X0` while reporting a
+  real `X` error as clean — exactly inverted. `unitOf` now maps the LCG state
+  onto the unit interval at every site. Clean codewords give syndrome `[0,0]`;
+  `X` on qubit 0 gives `[1,0]`; `measureZ` on `|0>` gives 1000/0.
+
+- **`STEANE_CODE` was not a stabiliser group.** `[[7,1,3]]` needs `n - k = 6`
+  generators; it listed 7, of GF(2) rank 6, with 13 of 21 pairs anticommuting.
+  The `n`-bit representation could not express a CSS code at all — an X-type and
+  a Z-type generator over the same support are different operators but identical
+  bit patterns. `StabilizerCode.generators` is now symplectic, `[x | z]` of `2n`
+  bits, with `xGenerators`/`zGenerators` alongside, and Steane is built from the
+  three `[7,4,3]` Hamming checks used once as X-type and once as Z-type: 6
+  generators, symplectic rank 6, zero anticommuting pairs.
+
+  `npm run quantum:sim` reported 257 checks passing both before and after this
+  fix, including `QEC` and `state-tomography`. Neither defect was reachable from
+  any of them.
+
+### Changed — the Lean bridge stops claiming what it never checked
+
+- It reported `Verified: 2/2`, `Confidence: 100.0%` and `Production Grade
+  (Formally Verified)`, and exported `ready_for_publication: true`. None was
+  measured: the hash covered the theorem's *name*, so it never moved when a
+  proof changed, and `verifyProofCertificate` tested that some strings were
+  non-empty and a hash was 16 characters — true of every certificate the file
+  can build. `lean_version` was asserted although no Lean runs here, and 7 of
+  the 13 Lean scripts end in `sorry`.
+
+- A certificate now carries two separately reported facts. `lean_status` is
+  **read** from the script — `script`, `sorry`, `axiom` or `absent`. `seal` is
+  whether a recomputable predicate ran and held against the simulator. Verified
+  means the seal held. The hash covers statement and script.
+
+- All 8 theorems in the report now seal, each with a `basis` string saying
+  whether it decides the general statement or one instance — `grover_speedup`
+  at N=16 is not an asymptotic bound and says so. `ready_for_publication`
+  remains **false**: seals are computed instances, not machine-checked proofs,
+  and no Lean toolchain runs in this repository.
+
+- `kyber_security` claimed 128. ML-KEM-768 is NIST **category 3**.
+
+- `test:verification` runs the seals on every gate.
+
+### Known limitations
+
+- **ML-KEM-768 here is not constant time.** JavaScript cannot promise that —
+  array indexing, JIT deoptimisation and garbage collection all leak timing.
+  Do not use it where an attacker can measure decapsulation. Conformance to
+  FIPS 203 output is a separate property from side-channel resistance, and only
+  the first is claimed.
+- Every limitation listed under 1.0.4 and 1.0.3 still applies, except the
+  `kyber-real.ts` warning, which no longer has a file to attach to.
+
+## 1.0.4
+
+### Fixed — cryptography
+
+- **Kyber-768 encapsulate/decapsulate never agreed**, published 1.0.3
+  included. Two independent defects, either alone fatal. 12-bit serialization
+  guarded the carry byte on `shift > 0`, so every even-indexed coefficient
+  above 255 was truncated to its low byte — 118 of 256 for a typical
+  polynomial, and both `t` and `s` are serialized. Message decode used a
+  single `>= q/2` threshold, but the ring wraps: a 0-bit nudged negative by
+  noise lands near `q` and read as 1, so bits flipped on noise sign alone.
+  The test is the band `[q/4, 3q/4)`. Compression also floored twice against
+  a `2^d - 1` scale, biasing one way each time; at `d=4` that bias was the
+  measured median decode error, ~111 against a budget of `q/4 = 832`. It
+  rounds to the spec's `2^d` scale now. Measured over 300 keypairs: median
+  error 111 → 52, max 404 → 193. 2000/2000 round trips recover the shared
+  secret.
+
+### Added — release gates
+
+- **`npm run check` is now the whole gate.** `docs:build` was the one CI step
+  outside it; a dead link in `QUANTUM_GUIDE.md` rode that gap through six
+  consecutive pushes with the gate green each time, and the published site did
+  not rebuild for two weeks. It runs in the chain now.
+- **Version sealing.** `package.json` is the single source of the release
+  number; `scripts/version-seal.mjs` derives `CITATION.cff`, a README block and
+  the CHANGELOG heading from it. `version:check` fails closed on drift, on a
+  missing or placeholder CHANGELOG entry, and on any version below an existing
+  CHANGELOG heading or git tag. Before this, `package.json` said 1.0.3 while
+  the README said 1.0.2. `npm version patch|minor|major` now reseals and tags
+  in one step.
+- **`version:test`, `test:quantum`, `test:crypto`.** The version gate ships a
+  10-case self-test, 9 of them failures it must catch, so a gate that cannot
+  fail is detectable. Four test suites that existed and passed were executed by
+  nothing; they run on every gate now.
+
+### Known limitations
+
+- `src/crypto/kyber-real.ts` **is not ML-KEM and must not protect anything.**
+  It is not a package export, but `files` ships `src/**/*.ts`, so a deep import
+  can reach it. The matrix `A` is CBD-sampled into `{-1,0,1}` instead of
+  uniform mod `q`, so the module-LWE instance underneath is not the hard
+  problem; noise is `eta=1` where ML-KEM-768 wants 2; SHA-256 stands in for
+  SHAKE; `e1`/`e2` are omitted; there is no Fujisaki-Okamoto step, so no
+  IND-CCA2 claim. The round trip is correct; the cryptography is not.
+- Every limitation listed under 1.0.3 still applies.
+
 ## 1.0.3
 
 ### Fixed — packaging (1.0.0–1.0.2 were unusable in these ways)
@@ -64,6 +208,14 @@ primitive it replaced. **These change results**; review if you depend on them.
   **TypeScript 7 is deliberately held back** — it breaks the build
   (`@rollup/plugin-typescript` throws on it).
 
+### Superseded by 1.0.4
+
+Published from a commit three behind `main`. It ships
+`src/crypto/kyber-real.ts` with a round trip that never recovers the shared
+secret — 0 of 20 measured against the published tarball — under a header
+reading "Real NIST FIPS 203 Implementation" and "NOT a toy version - actual
+cryptographic implementation". Both claims were false. Use 1.0.4.
+
 ### Known limitations
 
 - `./kernel`, `./kernel/import-graph`, `./0`, `./integrity` and `./mcp` point
@@ -82,4 +234,4 @@ primitive it replaced. **These change results**; review if you depend on them.
 ## 1.0.2 and earlier — deprecated
 
 Broken as published: the CJS entry cannot load, and the tarball ships 87 MB of
-scanned book imagery. Use 1.0.3.
+scanned book imagery. Use 1.0.4.

package/CITATION.cff

@@ -20,7 +20,7 @@ authors:
     email: node@zeropoint.bg
 repository-code: https://github.com/ceccec/zeropoint-node
 url: https://node.zeropoint.bg
-version: 1.0.3
+version: 1.0.5
 license: CC-BY-NC-ND-4.0
 license-url: https://github.com/ceccec/zeropoint-node/blob/main/LICENSE
 keywords:

package/README.md

@@ -472,7 +472,7 @@ The A432 Consciousness System is an open-source project that welcomes contributi
 
 <!-- VERSION:BEGIN — generated by scripts/version-seal.mjs; do not edit by hand -->
 
-Package: **`zeropoint-node@1.0.3`** · owner `ceccec` · git tag `v1.0.3`
+Package: **`zeropoint-node@1.0.5`** · owner `ceccec` · git tag `v1.0.5`
 
 npm rejects republishing a version that already exists, so every release is a
 new number. Bump with `npm version patch|minor|major`: that reseals CITATION.cff

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zeropoint-node",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "type": "module",
   "description": "A432 Consciousness System: Self-evolving, self-aware consciousness technology with Transurfing integration, harmonic mathematics, zero-entropy principles, Kabbalistic cycles, and sacred geometry",
   "main": "dist/a432.system.cjs",
@@ -124,6 +124,9 @@
     "test:kernel": "node --experimental-strip-types src/kernel/smoke.test.ts",
     "test:security": "node --experimental-strip-types src/security/quantum-fold-cipher.test.ts > /dev/null && node --experimental-strip-types src/security/quantum-state-tomography.test.ts > /dev/null && node --experimental-strip-types src/security/quantum-proofs.test.ts > /dev/null && node --experimental-strip-types src/security/post-quantum-crypto.test.ts > /dev/null && echo security tests ok",
     "test:quantum": "node --experimental-strip-types src/quantum/superposition-execution.test.ts > /dev/null && node --experimental-strip-types src/quantum/millennium-bridge.test.ts > /dev/null && node --experimental-strip-types src/quantum/zenodo-publisher.test.ts > /dev/null && echo quantum tests ok",
+    "test:crypto": "node --experimental-strip-types src/crypto/ml-kem.test.ts > /dev/null && echo crypto tests ok",
+    "test:verification": "node --experimental-strip-types src/verification/lean-bridge.test.ts > /dev/null && echo verification seals ok",
+    "kat:ml-kem": "node --experimental-strip-types scripts/ml-kem-accumulated-kat.mjs",
     "readme": "node --experimental-strip-types scripts/readme-gen.mjs",
     "readme:check": "node --experimental-strip-types scripts/readme-gen.mjs --check",
     "docs:pages": "node --experimental-strip-types scripts/docs-pages.mjs",
@@ -156,7 +159,7 @@
     "vortex:svg:check": "node --experimental-strip-types scripts/vortex-svg.mjs --check",
     "bundle:a432": "node scripts/build-a432-bundle.mjs",
     "bundle:a432:check": "node scripts/build-a432-bundle.mjs --check",
-    "check": "npm run version:test && npm run version:check && npm run test:kernel && npm run test:security && npm run test:quantum && npm run math:ban && npm run bundle:a432:check && npm run skills:seal && npm run skills:check && npm run readme && npm run readme:check && npm run docs:pages && npm run docs:pages:check && npm run a432:scan && npm run a432:scan:check && npm run docs:index && npm run docs:index:check && npm run spectrum && npm run spectrum:check && npm run vortex:svg && npm run vortex:svg:check && npm run quantum:sim && npm run ratchet:check && npm run mcp:smoke && npm run self:next",
+    "check": "npm run version:test && npm run version:check && npm run test:kernel && npm run test:security && npm run test:quantum && npm run test:crypto && npm run test:verification && npm run math:ban && npm run bundle:a432:check && npm run skills:seal && npm run skills:check && npm run readme && npm run readme:check && npm run docs:pages && npm run docs:pages:check && npm run a432:scan && npm run a432:scan:check && npm run docs:index && npm run docs:index:check && npm run spectrum && npm run spectrum:check && npm run vortex:svg && npm run vortex:svg:check && npm run docs:build && npm run quantum:sim && npm run ratchet:check && npm run mcp:smoke && npm run self:next",
     "prepublishOnly": "npm run build",
     "prose": "node scripts/prose-claims.mjs --list",
     "prose:check": "node scripts/prose-claims.mjs",