bitspark-archon-core 0.7.0__tar.gz

bitspark_archon_core-0.7.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

bitspark_archon_core-0.7.0/NOTICE

@@ -0,0 +1,4 @@
+archon
+Copyright 2026 Bitspark and the archon contributors
+
+This product includes software developed at Bitspark (https://github.com/Bitspark).

bitspark_archon_core-0.7.0/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: bitspark-archon-core
+Version: 0.7.0
+Summary: archon core: Ed25519 primitives, the canonical key spelling, and the SPKI/PKCS-8 key codec. The identity floor beneath the law.
+Author: Bitspark
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/Bitspark/archon
+Project-URL: Documentation, https://github.com/Bitspark/archon/tree/main/docs
+Project-URL: Repository, https://github.com/Bitspark/archon
+Project-URL: Issues, https://github.com/Bitspark/archon/issues
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security :: Cryptography
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: pycryptodome>=3.20
+Dynamic: license-file
+
+# archon core — Python
+
+The identity floor in Python: Ed25519 key bytes, one canonical text spelling, the SPKI and
+PKCS-8 codecs, and domain-separated signing.
+
+```console
+pip install bitspark-archon-core
+```
+
+The distribution is `bitspark-archon-core`; the import is `archon_core`. The prefix is a
+registry name only — PyPI, like crates.io, has a single flat namespace.
+
+```python
+from archon_core import (
+    public_key_from_seed, encode_key, sign_in_domain, verify_in_domain,
+)
+
+seed = bytes(range(32))
+pub  = public_key_from_seed(seed)
+
+encode_key(pub)
+# 'ed25519:03a107bff3ce10be1d70dd18e74bc09967e4d6309ba50d5f1ddc8664125531b8'
+
+sig = sign_in_domain(seed, "example.v1", b"hello")
+verify_in_domain(pub, "example.v1", b"hello", sig)   # True
+verify_in_domain(pub, "other.v1",   b"hello", sig)   # False — domains do not cross
+```
+
+## What it is
+
+Two questions and no others: *are these bytes that key*, and *is this signature that key's*.
+Authority and custody belong to their own layers — see the
+[repository README](https://github.com/Bitspark/archon).
+
+| | |
+|---|---|
+| `crypto` | `public_key_from_seed`, `sign`/`verify`, `sign_in_domain`/`verify_in_domain` |
+| `hexbytes` | `to_hex`, and fixed-size decoders that accept exactly N bytes or fail |
+| `keytext` | `encode_key`/`decode_key` — `ed25519:<64 hex>` |
+| `keycodec` | RFC 5280 SPKI and RFC 5958 PKCS-8 v1 PEM, as a byte codec |
+
+## Agreement is the claim
+
+This core is held to the same hand-authored oracle as the Go, Rust and TypeScript cores —
+60 cases in [`vectors/identity.json`](https://github.com/Bitspark/archon/blob/main/vectors/identity.json),
+recomputed rather than echoed. If it disagrees with the others about whether something is a
+valid key, signature or key text, that disagreement is the defect.
+
+Two places where Python needed care to agree, both recorded in the source:
+
+- **`sign_in_domain` is Ed25519ph with the domain as the RFC 8032 §5.1 context.**
+  `cryptography` cannot express it — it offers only pure `sign(data)`. This package binds
+  **PyCryptodome**, which can.
+- **Small-order public keys are rejected.** PyCryptodome's verifier accepts them; Go's
+  `crypto/ed25519` and `ed25519-dalek` do not. archon's profile is to reject, so `verify`
+  checks `[8]A` against the identity using the library's own point arithmetic. Without it,
+  two oracle cases pass in Python and fail everywhere else.
+
+## Verification
+
+Signing raises rather than silently signing raw: an empty domain, or one over 255 bytes, is
+an error. Verification is total — every shape failure returns `False`, so a caller cannot
+mistake *malformed* for *valid*.
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).

bitspark_archon_core-0.7.0/README.md

@@ -0,0 +1,67 @@
+# archon core — Python
+
+The identity floor in Python: Ed25519 key bytes, one canonical text spelling, the SPKI and
+PKCS-8 codecs, and domain-separated signing.
+
+```console
+pip install bitspark-archon-core
+```
+
+The distribution is `bitspark-archon-core`; the import is `archon_core`. The prefix is a
+registry name only — PyPI, like crates.io, has a single flat namespace.
+
+```python
+from archon_core import (
+    public_key_from_seed, encode_key, sign_in_domain, verify_in_domain,
+)
+
+seed = bytes(range(32))
+pub  = public_key_from_seed(seed)
+
+encode_key(pub)
+# 'ed25519:03a107bff3ce10be1d70dd18e74bc09967e4d6309ba50d5f1ddc8664125531b8'
+
+sig = sign_in_domain(seed, "example.v1", b"hello")
+verify_in_domain(pub, "example.v1", b"hello", sig)   # True
+verify_in_domain(pub, "other.v1",   b"hello", sig)   # False — domains do not cross
+```
+
+## What it is
+
+Two questions and no others: *are these bytes that key*, and *is this signature that key's*.
+Authority and custody belong to their own layers — see the
+[repository README](https://github.com/Bitspark/archon).
+
+| | |
+|---|---|
+| `crypto` | `public_key_from_seed`, `sign`/`verify`, `sign_in_domain`/`verify_in_domain` |
+| `hexbytes` | `to_hex`, and fixed-size decoders that accept exactly N bytes or fail |
+| `keytext` | `encode_key`/`decode_key` — `ed25519:<64 hex>` |
+| `keycodec` | RFC 5280 SPKI and RFC 5958 PKCS-8 v1 PEM, as a byte codec |
+
+## Agreement is the claim
+
+This core is held to the same hand-authored oracle as the Go, Rust and TypeScript cores —
+60 cases in [`vectors/identity.json`](https://github.com/Bitspark/archon/blob/main/vectors/identity.json),
+recomputed rather than echoed. If it disagrees with the others about whether something is a
+valid key, signature or key text, that disagreement is the defect.
+
+Two places where Python needed care to agree, both recorded in the source:
+
+- **`sign_in_domain` is Ed25519ph with the domain as the RFC 8032 §5.1 context.**
+  `cryptography` cannot express it — it offers only pure `sign(data)`. This package binds
+  **PyCryptodome**, which can.
+- **Small-order public keys are rejected.** PyCryptodome's verifier accepts them; Go's
+  `crypto/ed25519` and `ed25519-dalek` do not. archon's profile is to reject, so `verify`
+  checks `[8]A` against the identity using the library's own point arithmetic. Without it,
+  two oracle cases pass in Python and fail everywhere else.
+
+## Verification
+
+Signing raises rather than silently signing raw: an empty domain, or one over 255 bytes, is
+an error. Verification is total — every shape failure returns `False`, so a caller cannot
+mistake *malformed* for *valid*.
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).

bitspark_archon_core-0.7.0/pyproject.toml

@@ -0,0 +1,43 @@
+[build-system]
+requires = ["setuptools>=77.0.3"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bitspark-archon-core"
+version = "0.7.0"
+description = "archon core: Ed25519 primitives, the canonical key spelling, and the SPKI/PKCS-8 key codec. The identity floor beneath the law."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+license-files = ["LICENSE", "NOTICE"]
+authors = [{ name = "Bitspark" }]
+
+# One runtime dependency, and the choice is load-bearing. `cryptography` exposes only
+# `sign(data)` — pure Ed25519 — while archon's domain separation is Ed25519ph with the domain
+# as the RFC 8032 context. PyCryptodome's `eddsa.new(key, 'rfc8032', context=…)` is the one
+# mainstream Python route to that primitive.
+dependencies = ["pycryptodome>=3.20"]
+
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security :: Cryptography",
+  "Typing :: Typed",
+]
+
+[project.urls]
+Homepage = "https://github.com/Bitspark/archon"
+Documentation = "https://github.com/Bitspark/archon/tree/main/docs"
+Repository = "https://github.com/Bitspark/archon"
+Issues = "https://github.com/Bitspark/archon/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+archon_core = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["test"]

bitspark_archon_core-0.7.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

bitspark_archon_core-0.7.0/src/archon_core/__init__.py

@@ -0,0 +1,54 @@
+"""archon core — the identity floor in Python.
+
+Ed25519 key bytes, one canonical text spelling, the SPKI/PKCS-8 codecs, and
+domain-separated signing. It answers two questions — are these bytes that key, and is this
+signature that key's — and nothing about authority or custody.
+
+This core is held to the same hand-authored oracle as the Go, Rust and TypeScript cores;
+if it disagrees with them about whether something is valid, that disagreement is the defect.
+"""
+
+from .crypto import (
+    MAX_DOMAIN_SIZE,
+    PUBLIC_KEY_SIZE,
+    SEED_SIZE,
+    SIGNATURE_SIZE,
+    public_key_from_seed,
+    sign,
+    sign_in_domain,
+    verify,
+    verify_in_domain,
+)
+from .hexbytes import pubkey_from_hex, seed_from_hex, signature_from_hex, to_hex
+from .keycodec import (
+    pkcs8_pem_to_seed,
+    pubkey_to_spki_pem,
+    seed_to_pkcs8_pem,
+    spki_pem_to_pubkey,
+)
+from .keytext import decode_key, encode_key
+
+__version__ = "0.7.0"
+
+__all__ = [
+    "MAX_DOMAIN_SIZE",
+    "PUBLIC_KEY_SIZE",
+    "SEED_SIZE",
+    "SIGNATURE_SIZE",
+    "public_key_from_seed",
+    "sign",
+    "verify",
+    "sign_in_domain",
+    "verify_in_domain",
+    "to_hex",
+    "seed_from_hex",
+    "pubkey_from_hex",
+    "signature_from_hex",
+    "encode_key",
+    "decode_key",
+    "pubkey_to_spki_pem",
+    "seed_to_pkcs8_pem",
+    "spki_pem_to_pubkey",
+    "pkcs8_pem_to_seed",
+    "__version__",
+]

bitspark_archon_core-0.7.0/src/archon_core/_conformance.py

@@ -0,0 +1,132 @@
+"""Conformance CLI (python) — a dev/CI artifact, not part of the library surface.
+
+Implements the `conformance v1` protocol: `conformance <family>` reads the whole
+vectors/identity.json on stdin, selects its family's cases, RECOMPUTES each result from the
+case INPUTS (ignoring the expected value the oracle carries), and writes one NDJSON line per
+case to stdout in input order. The harness drives this and the other cores as black boxes and
+asserts each line against the oracle.
+
+    pubkey_from_seed : in {name, seed}                  out {"name","pubkey":"<64-hex>"}
+    key_encode       : in {name, pubkey}                out {"name","text":"<key text>"}
+    keycodec         : in {name, kind, key?|pem?}       out {"name","result":{"ok":…}|{"error":true}}
+    signature_verify : in {name, pubkey, message, sig}  out {"name","valid":<bool>}
+    hex_decode       : in {name, kind, hex}             out {"name","result":{"ok":"<hex>"}|{"error":true}}
+    domain_sign      : in {name, seed, domain, message} out {"name","result":{"ok":"<128-hex>"}|{"error":true}}
+    domain_verify    : in {name, pubkey, domain, message, sig} out {"name","valid":<bool>}
+
+Recomputing rather than echoing is the whole point: a CLI that read `result` from the case
+would agree with the oracle by construction and prove nothing.
+"""
+
+import json
+import sys
+
+from . import crypto, hexbytes, keycodec, keytext
+
+
+def _result_of(value, err):
+    """The oracle's two-shape result: {"ok": …} or {"error": true}."""
+    return {"error": True} if err is not None else {"ok": value}
+
+
+def _try(fn):
+    try:
+        return fn(), None
+    except Exception as exc:  # noqa: BLE001 - every failure is one refusal to the oracle
+        return None, exc
+
+
+def _unhex(text: str) -> bytes:
+    # Case inputs that are *already* known-good hex; a bad one is a broken vector file,
+    # not a case the family is testing.
+    return bytes.fromhex(text)
+
+
+def main(argv=None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+    if len(argv) != 1:
+        print("usage: conformance <family>", file=sys.stderr)
+        return 2
+    family = argv[0]
+
+    doc = json.load(sys.stdin)
+    cases = doc.get(family)
+    if cases is None:
+        print(f"conformance: no such family: {family}", file=sys.stderr)
+        return 1
+
+    out_lines = []
+    for case in cases:
+        # The oracle carries a leading note object in some families; it has no name.
+        if "name" not in case:
+            continue
+        out = {"name": case["name"]}
+
+        if family == "pubkey_from_seed":
+            pub = crypto.public_key_from_seed(_unhex(case["seed"]))
+            out["pubkey"] = hexbytes.to_hex(pub)
+
+        elif family == "key_encode":
+            out["text"] = keytext.encode_key(_unhex(case["pubkey"]))
+
+        elif family == "keycodec":
+            kind = case["kind"]
+            if kind == "encode_pkcs8":
+                v, e = _try(lambda: keycodec.seed_to_pkcs8_pem(_unhex(case["key"])).decode("ascii"))
+            elif kind == "encode_spki":
+                v, e = _try(lambda: keycodec.pubkey_to_spki_pem(_unhex(case["key"])).decode("ascii"))
+            elif kind == "decode_pkcs8":
+                v, e = _try(lambda: hexbytes.to_hex(keycodec.pkcs8_pem_to_seed(case["pem"].encode("utf-8"))))
+            elif kind == "decode_spki":
+                v, e = _try(lambda: hexbytes.to_hex(keycodec.spki_pem_to_pubkey(case["pem"].encode("utf-8"))))
+            else:
+                raise SystemExit(f"unknown keycodec kind: {kind}")
+            out["result"] = _result_of(v, e)
+
+        elif family == "signature_verify":
+            out["valid"] = crypto.verify(
+                _unhex(case["pubkey"]), _unhex(case["message"]), _unhex(case["sig"])
+            )
+
+        elif family == "hex_decode":
+            kind = case["kind"]
+            fn = {
+                "seed": hexbytes.seed_from_hex,
+                "pubkey": hexbytes.pubkey_from_hex,
+                "signature": hexbytes.signature_from_hex,
+            }.get(kind)
+            if fn is None:
+                raise SystemExit(f"unknown hex_decode kind: {kind}")
+            v, e = _try(lambda: hexbytes.to_hex(fn(case["hex"])))
+            out["result"] = _result_of(v, e)
+
+        elif family == "domain_sign":
+            v, e = _try(
+                lambda: hexbytes.to_hex(
+                    crypto.sign_in_domain(
+                        _unhex(case["seed"]), case["domain"], _unhex(case["message"])
+                    )
+                )
+            )
+            out["result"] = _result_of(v, e)
+
+        elif family == "domain_verify":
+            out["valid"] = crypto.verify_in_domain(
+                _unhex(case["pubkey"]),
+                case["domain"],
+                _unhex(case["message"]),
+                _unhex(case["sig"]),
+            )
+
+        else:
+            print(f"conformance: unhandled family: {family}", file=sys.stderr)
+            return 1
+
+        out_lines.append(json.dumps(out, separators=(",", ":"), sort_keys=True))
+
+    sys.stdout.write("\n".join(out_lines) + ("\n" if out_lines else ""))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

bitspark_archon_core-0.7.0/src/archon_core/crypto.py

@@ -0,0 +1,178 @@
+"""Ed25519 signing and verification — the floor's only cryptography.
+
+Like the other cores, this binds an existing Ed25519 implementation and writes none of its
+own curve arithmetic. The binding here is PyCryptodome, chosen for one reason the mainstream
+alternative cannot meet: `sign_in_domain` is Ed25519ph with the domain as the RFC 8032 §5.1
+context string, and `cryptography`'s Ed25519 exposes only `sign(data)` — pure Ed25519, no
+prehash, no context. PyCryptodome's `eddsa.new(key, 'rfc8032', context=...)` reaches it.
+
+- `sign` / `verify` — raw Ed25519 over the message bytes.
+- `sign_in_domain` / `verify_in_domain` — DOMAIN-SEPARATED: Ed25519ph with the domain as the
+  context. A signature made in one domain verifies in no other and never as a raw signature.
+
+Verification is fail-closed: every shape failure collapses to False rather than raising, so a
+caller cannot mistake "malformed" for "valid".
+"""
+
+from Crypto.Hash import SHA512
+from Crypto.PublicKey import ECC
+from Crypto.Signature import eddsa
+
+PUBLIC_KEY_SIZE = 32
+SIGNATURE_SIZE = 64
+SEED_SIZE = 32
+#: The longest domain (RFC 8032 context) a signature can be made in, in bytes.
+MAX_DOMAIN_SIZE = 255
+
+__all__ = [
+    "PUBLIC_KEY_SIZE",
+    "SIGNATURE_SIZE",
+    "SEED_SIZE",
+    "MAX_DOMAIN_SIZE",
+    "public_key_from_seed",
+    "sign",
+    "verify",
+    "sign_in_domain",
+    "verify_in_domain",
+]
+
+
+def _private(seed: bytes):
+    if len(seed) != SEED_SIZE:
+        raise ValueError(f"crypto: seed must be {SEED_SIZE} bytes, got {len(seed)}")
+    return ECC.construct(curve="Ed25519", seed=bytes(seed))
+
+
+def _public(pubkey: bytes):
+    # Importing an encoded SPKI is the only route PyCryptodome offers from 32 raw bytes.
+    return ECC.import_key(_SPKI_PREFIX + bytes(pubkey))
+
+
+# The order of the prime-order subgroup, L = 2^252 + 27742317777372353535851937790883648493.
+_L = 0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED
+
+
+def _is_prime_order_point(encoded: bytes) -> bool:
+    """ADR 0008: `encoded` is a canonical encoding of a point of order exactly L.
+
+    False for a point not on the curve, a non-canonical spelling (y >= p, or x = 0 with the
+    sign bit set: the point re-encodes to different bytes), the identity, any small-order
+    point and any mixed-order point. This is archon's acceptance policy, not the library's:
+    RFC 8032 permits more than one verification equation, and implementations genuinely
+    differ — PyCryptodome's is cofactored, so on its own it accepts a mixed-order key for
+    every message and a small-order R, where Go and ed25519-dalek (uncofactored) accept the
+    former for one message in eight and refuse the latter. Restricting both points to the
+    prime-order subgroup is where the two equations agree; checking it here, explicitly, is
+    what makes the accepted set archon's rather than the library's.
+
+    It is a check, not curve arithmetic we wrote: `[L]A` uses the library's own point
+    multiplication, and a point is in the prime-order subgroup exactly when `[L]A` is the
+    identity. That is stronger than a small-order check (`[8]A`), which passes a mixed-order
+    point, and stronger than a blocklist, which misses non-canonical spellings.
+    """
+    try:
+        key = ECC.import_key(_SPKI_PREFIX + bytes(encoded))
+        if key.public_key().export_key(format="raw") != bytes(encoded):
+            return False
+        point = key.pointQ
+        if _is_identity(point):
+            return False
+        return _is_identity(point * _L)
+    except Exception:  # noqa: BLE001 - an unusable point is not a valid key either
+        return False
+
+
+def _is_identity(point) -> bool:
+    """The identity is (0, 1) — both coordinates, deliberately.
+
+    PyCryptodome's `EccPoint.is_point_at_infinity()` on an Edwards curve tests `x == 0`
+    alone, which the order-2 point (0, -1) satisfies too. Its arithmetic is right: for a
+    key with an order-2 torsion component, `[L]A` really is (0, -1) — but that method calls
+    it the identity, and the subgroup check would pass a mixed-order key. Found by the
+    differential run (`conformance/profile-cases.mjs differential`) on its first pass, in
+    the one class the fixed vectors happened not to draw.
+    """
+    return point.is_point_at_infinity() and int(point.y) == 1
+
+
+def _in_profile(pubkey: bytes, signature: bytes) -> bool:
+    """The profile's shape conditions: sizes, and A and R prime-order points. S's range
+    (0 <= S < L) is PyCryptodome's own check, so it is not repeated here."""
+    return (
+        len(pubkey) == PUBLIC_KEY_SIZE
+        and len(signature) == SIGNATURE_SIZE
+        and _is_prime_order_point(pubkey)
+        and _is_prime_order_point(signature[:PUBLIC_KEY_SIZE])
+    )
+
+
+# The SPKI template keycodec also uses. Importing an encoded public key is the only route
+# PyCryptodome offers from 32 raw bytes, so the prefix lives here too rather than crossing a
+# module boundary for four constants.
+_SPKI_PREFIX = bytes(
+    [0x30, 0x2A, 0x30, 0x05, 0x06, 0x03, 0x2B, 0x65, 0x70, 0x03, 0x21, 0x00]
+)
+
+
+def public_key_from_seed(seed: bytes) -> bytes:
+    """The 32-byte public key for `seed`. Raises when the seed is not 32 bytes."""
+    return _private(seed).public_key().export_key(format="raw")
+
+
+def sign(seed: bytes, message: bytes) -> bytes:
+    """A raw Ed25519 signature over `message`."""
+    return eddsa.new(_private(seed), "rfc8032").sign(bytes(message))
+
+
+def verify(pubkey: bytes, message: bytes, signature: bytes) -> bool:
+    """True when `signature` is `pubkey`'s over `message`, within the verification
+    profile (ADR 0008). False on any shape failure, including a key or an R outside the
+    profile."""
+    if not _in_profile(pubkey, signature):
+        return False
+    try:
+        eddsa.new(_public(pubkey), "rfc8032").verify(bytes(message), bytes(signature))
+        return True
+    except (ValueError, TypeError):
+        return False
+
+
+def _check_domain(domain: str) -> None:
+    # A domain is 1..=255 bytes of UTF-8. `str.encode` raises (a ValueError) on a lone
+    # surrogate rather than substituting, which is the behaviour the profile requires.
+    n = len(domain.encode("utf-8"))
+    if n == 0:
+        raise ValueError("crypto: domain is empty")
+    if n > MAX_DOMAIN_SIZE:
+        raise ValueError(f"crypto: domain is {n} bytes, max {MAX_DOMAIN_SIZE}")
+
+
+def sign_in_domain(seed: bytes, domain: str, message: bytes) -> bytes:
+    """Signs `message` in `domain` — Ed25519ph with the domain as the RFC 8032 context.
+
+    Raises, never silently signs raw, when the domain is empty or longer than 255 bytes.
+    """
+    _check_domain(domain)
+    digest = SHA512.new(bytes(message))
+    signer = eddsa.new(_private(seed), "rfc8032", context=domain.encode("utf-8"))
+    return signer.sign(digest)
+
+
+def verify_in_domain(
+    pubkey: bytes, domain: str, message: bytes, signature: bytes
+) -> bool:
+    """True when `signature` is `pubkey`'s over `message` IN `domain`, within the
+    verification profile (ADR 0008). False otherwise."""
+    try:
+        _check_domain(domain)
+    except ValueError:
+        return False
+    if not _in_profile(pubkey, signature):
+        return False
+    try:
+        digest = SHA512.new(bytes(message))
+        verifier = eddsa.new(_public(pubkey), "rfc8032", context=domain.encode("utf-8"))
+        verifier.verify(digest, bytes(signature))
+        return True
+    except (ValueError, TypeError):
+        return False

bitspark_archon_core-0.7.0/src/archon_core/hexbytes.py

@@ -0,0 +1,47 @@
+"""Typed, fail-closed hex spellings.
+
+Not a hex helper — every language has one — but the FIXED SIZE. Each decoder accepts exactly
+its type's byte count or fails; the length is checked on the TEXT before any byte is decoded,
+so a wrong-length input never reaches the decoder. Either case in, lowercase out. No `0x`, no
+whitespace, no odd-length bodies.
+"""
+
+from .crypto import PUBLIC_KEY_SIZE, SEED_SIZE, SIGNATURE_SIZE
+
+__all__ = ["to_hex", "seed_from_hex", "pubkey_from_hex", "signature_from_hex"]
+
+_HEX_DIGITS = frozenset("0123456789abcdefABCDEF")
+
+
+def to_hex(data: bytes) -> str:
+    """Lowercase hex, no prefix."""
+    return bytes(data).hex()
+
+
+def _fixed(text: str, n: int, what: str) -> bytes:
+    if len(text) != n * 2:
+        raise ValueError(
+            f"hexbytes: {what} hex is {len(text)} characters, expected {n * 2}"
+        )
+    # Python's bytes.fromhex accepts whitespace; archon's grammar does not. Check the
+    # alphabet explicitly rather than relying on the decoder's laxer rules — the other
+    # cores reject a space here, and agreement is the point.
+    for ch in text:
+        if ch not in _HEX_DIGITS:
+            raise ValueError(f"hexbytes: {what}: non-hex character {ch!r}")
+    return bytes.fromhex(text)
+
+
+def seed_from_hex(text: str) -> bytes:
+    """Exactly 32 bytes, or raises."""
+    return _fixed(text, SEED_SIZE, "seed")
+
+
+def pubkey_from_hex(text: str) -> bytes:
+    """Exactly 32 bytes, or raises."""
+    return _fixed(text, PUBLIC_KEY_SIZE, "public key")
+
+
+def signature_from_hex(text: str) -> bytes:
+    """Exactly 64 bytes, or raises."""
+    return _fixed(text, SIGNATURE_SIZE, "signature")

bitspark_archon_core-0.7.0/src/archon_core/keycodec.py

@@ -0,0 +1,86 @@
+"""The SPKI and PKCS-8 PEM codecs — a BYTE codec, not key custody.
+
+For an Ed25519 key the DER is fixed-length and fixed-shape, so this is a template match, not
+an ASN.1 parser: a 12-byte SPKI prefix or a 16-byte PKCS-8 v1 prefix, then exactly 32 key
+bytes. Anything else is refused. That is deliberate — a general parser would accept encodings
+the other cores would not, and agreement is the claim.
+
+RFC 5280 (SPKI) and RFC 5958 (PKCS-8 v1). PKCS-8 v2, which carries the public key alongside
+the private one, is NOT accepted: it is a second spelling of the same key.
+"""
+
+import base64
+
+from .crypto import PUBLIC_KEY_SIZE
+
+_KEY_LEN = PUBLIC_KEY_SIZE  # 32; the seed is the same length
+
+_SPKI_PREFIX = bytes(
+    [0x30, 0x2A, 0x30, 0x05, 0x06, 0x03, 0x2B, 0x65, 0x70, 0x03, 0x21, 0x00]
+)
+_PKCS8_PREFIX = bytes(
+    [
+        0x30, 0x2E, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,
+        0x03, 0x2B, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,
+    ]
+)
+
+_PEM_PUBLIC = "PUBLIC KEY"
+_PEM_PRIVATE = "PRIVATE KEY"
+
+__all__ = [
+    "pubkey_to_spki_pem",
+    "seed_to_pkcs8_pem",
+    "spki_pem_to_pubkey",
+    "pkcs8_pem_to_seed",
+]
+
+
+def _encode(key: bytes, prefix: bytes, pem_type: str) -> bytes:
+    if len(key) != _KEY_LEN:
+        raise ValueError(f"keycodec: key must be {_KEY_LEN} bytes, got {len(key)}")
+    body = base64.b64encode(prefix + bytes(key)).decode("ascii")
+    return (
+        f"-----BEGIN {pem_type}-----\n{body}\n-----END {pem_type}-----\n"
+    ).encode("ascii")
+
+
+def _decode(pem_bytes: bytes, prefix: bytes, pem_type: str) -> bytes:
+    text = bytes(pem_bytes).decode("ascii", errors="strict").replace("\r\n", "\n")
+    text = text.rstrip("\n")
+    begin = f"-----BEGIN {pem_type}-----"
+    end = f"-----END {pem_type}-----"
+    lines = text.split("\n")
+    if len(lines) < 3 or lines[0] != begin or lines[-1] != end:
+        raise ValueError(f"keycodec: not a {pem_type!r} PEM block")
+    try:
+        # validate=True: base64 that carries stray characters is refused rather than
+        # silently skipped, which is what a lax decoder would do.
+        der = base64.b64decode("".join(lines[1:-1]), validate=True)
+    except Exception as exc:  # noqa: BLE001 - surfaced as one codec error
+        raise ValueError(f"keycodec: invalid base64 in PEM body: {exc}") from exc
+    if len(der) != len(prefix) + _KEY_LEN or der[: len(prefix)] != prefix:
+        raise ValueError(
+            f"keycodec: DER does not match the {pem_type} ed25519-key-codec-v1 template"
+        )
+    return der[len(prefix) :]
+
+
+def pubkey_to_spki_pem(pubkey: bytes) -> bytes:
+    """A public key as an RFC 5280 SPKI PEM block."""
+    return _encode(pubkey, _SPKI_PREFIX, _PEM_PUBLIC)
+
+
+def seed_to_pkcs8_pem(seed: bytes) -> bytes:
+    """A seed as an RFC 5958 PKCS-8 v1 PEM block."""
+    return _encode(seed, _PKCS8_PREFIX, _PEM_PRIVATE)
+
+
+def spki_pem_to_pubkey(pem_bytes: bytes) -> bytes:
+    """The 32 public-key bytes from an SPKI PEM block, or raises."""
+    return _decode(pem_bytes, _SPKI_PREFIX, _PEM_PUBLIC)
+
+
+def pkcs8_pem_to_seed(pem_bytes: bytes) -> bytes:
+    """The 32 seed bytes from a PKCS-8 v1 PEM block, or raises."""
+    return _decode(pem_bytes, _PKCS8_PREFIX, _PEM_PRIVATE)

bitspark_archon_core-0.7.0/src/archon_core/keytext.py

@@ -0,0 +1,37 @@
+"""The canonical key spelling: `ed25519:<64 lowercase hex>`.
+
+One spelling, in every language. The prefix is required; the body is exactly 64 hex digits
+decoding to a 32-byte public key. Length and alphabet are part of the grammar, not decoration
+— a body of the wrong length is refused even when it is valid hex.
+"""
+
+from .crypto import PUBLIC_KEY_SIZE
+
+_PREFIX = "ed25519:"
+
+__all__ = ["encode_key", "decode_key"]
+
+_HEX_DIGITS = frozenset("0123456789abcdefABCDEF")
+
+
+def encode_key(pubkey: bytes) -> str:
+    """`ed25519:` followed by the key as lowercase hex."""
+    return _PREFIX + bytes(pubkey).hex()
+
+
+def decode_key(text: str) -> bytes:
+    """The 32 key bytes, or raises — missing prefix, odd length, non-hex, wrong size."""
+    if not text.startswith(_PREFIX):
+        raise ValueError(f"keytext: missing {_PREFIX!r} prefix")
+    body = text[len(_PREFIX) :]
+    if len(body) % 2 != 0:
+        raise ValueError("keytext: key body has an odd number of hex digits")
+    for ch in body:
+        if ch not in _HEX_DIGITS:
+            raise ValueError(f"keytext: non-hex character in key body: {ch!r}")
+    out = bytes.fromhex(body)
+    if len(out) != PUBLIC_KEY_SIZE:
+        raise ValueError(
+            f"keytext: decoded key is {len(out)} bytes, expected {PUBLIC_KEY_SIZE}"
+        )
+    return out

bitspark_archon_core-0.7.0/src/bitspark_archon_core.egg-info/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: bitspark-archon-core
+Version: 0.7.0
+Summary: archon core: Ed25519 primitives, the canonical key spelling, and the SPKI/PKCS-8 key codec. The identity floor beneath the law.
+Author: Bitspark
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/Bitspark/archon
+Project-URL: Documentation, https://github.com/Bitspark/archon/tree/main/docs
+Project-URL: Repository, https://github.com/Bitspark/archon
+Project-URL: Issues, https://github.com/Bitspark/archon/issues
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security :: Cryptography
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: pycryptodome>=3.20
+Dynamic: license-file
+
+# archon core — Python
+
+The identity floor in Python: Ed25519 key bytes, one canonical text spelling, the SPKI and
+PKCS-8 codecs, and domain-separated signing.
+
+```console
+pip install bitspark-archon-core
+```
+
+The distribution is `bitspark-archon-core`; the import is `archon_core`. The prefix is a
+registry name only — PyPI, like crates.io, has a single flat namespace.
+
+```python
+from archon_core import (
+    public_key_from_seed, encode_key, sign_in_domain, verify_in_domain,
+)
+
+seed = bytes(range(32))
+pub  = public_key_from_seed(seed)
+
+encode_key(pub)
+# 'ed25519:03a107bff3ce10be1d70dd18e74bc09967e4d6309ba50d5f1ddc8664125531b8'
+
+sig = sign_in_domain(seed, "example.v1", b"hello")
+verify_in_domain(pub, "example.v1", b"hello", sig)   # True
+verify_in_domain(pub, "other.v1",   b"hello", sig)   # False — domains do not cross
+```
+
+## What it is
+
+Two questions and no others: *are these bytes that key*, and *is this signature that key's*.
+Authority and custody belong to their own layers — see the
+[repository README](https://github.com/Bitspark/archon).
+
+| | |
+|---|---|
+| `crypto` | `public_key_from_seed`, `sign`/`verify`, `sign_in_domain`/`verify_in_domain` |
+| `hexbytes` | `to_hex`, and fixed-size decoders that accept exactly N bytes or fail |
+| `keytext` | `encode_key`/`decode_key` — `ed25519:<64 hex>` |
+| `keycodec` | RFC 5280 SPKI and RFC 5958 PKCS-8 v1 PEM, as a byte codec |
+
+## Agreement is the claim
+
+This core is held to the same hand-authored oracle as the Go, Rust and TypeScript cores —
+60 cases in [`vectors/identity.json`](https://github.com/Bitspark/archon/blob/main/vectors/identity.json),
+recomputed rather than echoed. If it disagrees with the others about whether something is a
+valid key, signature or key text, that disagreement is the defect.
+
+Two places where Python needed care to agree, both recorded in the source:
+
+- **`sign_in_domain` is Ed25519ph with the domain as the RFC 8032 §5.1 context.**
+  `cryptography` cannot express it — it offers only pure `sign(data)`. This package binds
+  **PyCryptodome**, which can.
+- **Small-order public keys are rejected.** PyCryptodome's verifier accepts them; Go's
+  `crypto/ed25519` and `ed25519-dalek` do not. archon's profile is to reject, so `verify`
+  checks `[8]A` against the identity using the library's own point arithmetic. Without it,
+  two oracle cases pass in Python and fail everywhere else.
+
+## Verification
+
+Signing raises rather than silently signing raw: an empty domain, or one over 255 bytes, is
+an error. Verification is total — every shape failure returns `False`, so a caller cannot
+mistake *malformed* for *valid*.
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).

bitspark_archon_core-0.7.0/src/bitspark_archon_core.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+LICENSE
+NOTICE
+README.md
+pyproject.toml
+src/archon_core/__init__.py
+src/archon_core/_conformance.py
+src/archon_core/crypto.py
+src/archon_core/hexbytes.py
+src/archon_core/keycodec.py
+src/archon_core/keytext.py
+src/archon_core/py.typed
+src/bitspark_archon_core.egg-info/PKG-INFO
+src/bitspark_archon_core.egg-info/SOURCES.txt
+src/bitspark_archon_core.egg-info/dependency_links.txt
+src/bitspark_archon_core.egg-info/requires.txt
+src/bitspark_archon_core.egg-info/top_level.txt
+test/test_core.py

bitspark_archon_core-0.7.0/src/bitspark_archon_core.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

bitspark_archon_core-0.7.0/src/bitspark_archon_core.egg-info/requires.txt

@@ -0,0 +1 @@
+pycryptodome>=3.20

bitspark_archon_core-0.7.0/src/bitspark_archon_core.egg-info/top_level.txt

@@ -0,0 +1 @@
+archon_core

bitspark_archon_core-0.7.0/test/test_core.py

@@ -0,0 +1,180 @@
+"""Unit tests for the Python core.
+
+The oracle in `vectors/identity.json` is the cross-language authority and is driven by
+`conformance/check.mjs`; these tests cover the same ground from inside Python, plus the
+argument-shape failures the oracle has no way to express (a raised exception, a wrong-sized
+seed) because its protocol only carries `ok` / `error`.
+"""
+
+import pytest
+
+from archon_core import (
+    MAX_DOMAIN_SIZE,
+    decode_key,
+    encode_key,
+    pkcs8_pem_to_seed,
+    pubkey_from_hex,
+    pubkey_to_spki_pem,
+    public_key_from_seed,
+    seed_from_hex,
+    seed_to_pkcs8_pem,
+    sign,
+    sign_in_domain,
+    signature_from_hex,
+    spki_pem_to_pubkey,
+    to_hex,
+    verify,
+    verify_in_domain,
+)
+
+SEED = bytes(range(32))
+MSG = b"hello"
+DOMAIN = "example.v1"
+
+
+# --- crypto ---------------------------------------------------------------------------
+
+def test_public_key_is_32_bytes_and_stable():
+    pub = public_key_from_seed(SEED)
+    assert len(pub) == 32
+    assert pub == public_key_from_seed(SEED)
+
+
+def test_seed_must_be_32_bytes():
+    with pytest.raises(ValueError):
+        public_key_from_seed(SEED[:31])
+
+
+def test_sign_verify_roundtrip():
+    assert verify(public_key_from_seed(SEED), MSG, sign(SEED, MSG))
+
+
+def test_verify_is_total_not_raising():
+    pub = public_key_from_seed(SEED)
+    sig = sign(SEED, MSG)
+    assert verify(pub, b"goodbye", sig) is False
+    assert verify(pub[:31], MSG, sig) is False          # short key
+    assert verify(pub, MSG, sig[:63]) is False          # short signature
+    assert verify(pub, MSG, bytes(64)) is False         # all-zero signature
+
+
+def test_domain_separation_is_cryptographic():
+    pub = public_key_from_seed(SEED)
+    sig = sign_in_domain(SEED, DOMAIN, MSG)
+    assert verify_in_domain(pub, DOMAIN, MSG, sig)
+    assert verify_in_domain(pub, "other.v1", MSG, sig) is False   # another domain
+    assert verify(pub, MSG, sig) is False                         # never as raw
+    assert verify_in_domain(pub, DOMAIN, MSG, sign(SEED, MSG)) is False  # raw never in a domain
+
+
+def test_domain_bounds():
+    with pytest.raises(ValueError):
+        sign_in_domain(SEED, "", MSG)                             # "sign in no domain"
+    with pytest.raises(ValueError):
+        sign_in_domain(SEED, "d" * (MAX_DOMAIN_SIZE + 1), MSG)
+    longest = "d" * MAX_DOMAIN_SIZE
+    assert verify_in_domain(
+        public_key_from_seed(SEED), longest, MSG, sign_in_domain(SEED, longest, MSG)
+    )
+
+
+def test_verify_in_domain_is_false_not_raising_on_bad_domain():
+    pub = public_key_from_seed(SEED)
+    sig = sign_in_domain(SEED, DOMAIN, MSG)
+    assert verify_in_domain(pub, "", MSG, sig) is False
+    assert verify_in_domain(pub, "d" * (MAX_DOMAIN_SIZE + 1), MSG, sig) is False
+
+
+@pytest.mark.parametrize(
+    "pubkey_hex",
+    [
+        "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+        "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+    ],
+)
+def test_small_order_public_keys_are_rejected(pubkey_hex):
+    """archon's profile rejects them; PyCryptodome's verifier alone would not.
+
+    These are the two oracle cases that disagreed before the explicit check existed.
+    """
+    pub = bytes.fromhex(pubkey_hex)
+    sig = pub + bytes(32)  # the R=A, S=0 shape the oracle uses
+    assert verify(pub, MSG, sig) is False
+    assert verify_in_domain(pub, DOMAIN, MSG, sig) is False
+
+
+# --- hexbytes -------------------------------------------------------------------------
+
+def test_hex_is_lowercase_and_fixed_size():
+    assert to_hex(b"\x00\xff") == "00ff"
+    assert seed_from_hex("AA" * 32) == bytes([0xAA]) * 32        # either case in
+    for bad in ["aa" * 31, "aa" * 33, "", "zz" * 32]:
+        with pytest.raises(ValueError):
+            seed_from_hex(bad)
+
+
+def test_hex_rejects_whitespace_that_python_would_otherwise_accept():
+    """`bytes.fromhex` tolerates spaces; archon's grammar does not, and the other cores
+    reject them. Agreement is the point."""
+    with pytest.raises(ValueError):
+        seed_from_hex("aa " * 16 + "aa" * 16)
+
+
+def test_hex_decoders_are_typed_by_length():
+    assert len(pubkey_from_hex("11" * 32)) == 32
+    assert len(signature_from_hex("11" * 64)) == 64
+    with pytest.raises(ValueError):
+        pubkey_from_hex("11" * 64)      # a signature is not a public key
+
+
+# --- keytext --------------------------------------------------------------------------
+
+def test_key_text_roundtrip():
+    pub = public_key_from_seed(SEED)
+    text = encode_key(pub)
+    assert text.startswith("ed25519:")
+    assert text == text.lower()
+    assert decode_key(text) == pub
+
+
+@pytest.mark.parametrize(
+    "bad",
+    [
+        "d75a98",                       # no prefix
+        "ed25519:abc",                  # odd number of digits
+        "ed25519:" + "zz" * 32,         # non-hex
+        "ed25519:" + "aa" * 31,         # decodes to the wrong size
+        "ED25519:" + "aa" * 32,         # the prefix is exact
+    ],
+)
+def test_key_text_refusals(bad):
+    with pytest.raises(ValueError):
+        decode_key(bad)
+
+
+# --- keycodec -------------------------------------------------------------------------
+
+def test_pem_roundtrips():
+    pub = public_key_from_seed(SEED)
+    assert spki_pem_to_pubkey(pubkey_to_spki_pem(pub)) == pub
+    assert pkcs8_pem_to_seed(seed_to_pkcs8_pem(SEED)) == SEED
+
+
+def test_pem_shape():
+    pem = pubkey_to_spki_pem(public_key_from_seed(SEED)).decode("ascii")
+    assert pem.startswith("-----BEGIN PUBLIC KEY-----\n")
+    assert pem.endswith("-----END PUBLIC KEY-----\n")
+
+
+def test_pem_accepts_crlf():
+    pem = seed_to_pkcs8_pem(SEED).decode("ascii")
+    assert pkcs8_pem_to_seed(pem.replace("\n", "\r\n").encode("ascii")) == SEED
+
+
+def test_pem_refuses_the_wrong_block_and_bad_template():
+    with pytest.raises(ValueError):
+        spki_pem_to_pubkey(seed_to_pkcs8_pem(SEED))       # private PEM to the public decoder
+    with pytest.raises(ValueError):
+        pubkey_to_spki_pem(b"\x00" * 31)                  # key must be 32 bytes
+    with pytest.raises(ValueError):
+        spki_pem_to_pubkey(b"-----BEGIN PUBLIC KEY-----\nbm90IERFUg==\n-----END PUBLIC KEY-----\n")