orangecheck 2.0.0__tar.gz → 2.2.0__tar.gz

{orangecheck-2.0.0 → orangecheck-2.2.0}/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to the **`orangecheck`** Python package. Follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 [Semantic Versioning](https://semver.org/).
 
+## [2.2.0] — 2026-10-16
+
+Matches `@orangecheck/sdk` 1.13.0 and the spec's regenerated `tv24`–`tv27`.
+
+### Changed (security)
+
+- `bond_nullifier(key, audience, outpoint)` takes the registry's secret key
+  (at least 32 bytes) and returns HMAC-SHA256. 2.1.0's unkeyed hash could be
+  inverted by hashing every unspent output, which found the coin.
+- The signed acknowledgement reads "I back this subject with this coin. It
+  stays in my wallet."
+
+### Added
+
+- `verify_bond_signature` refuses a signing window longer than an hour
+  (`bond_window_too_long`; `max_window_seconds`, `BOND_MAX_WINDOW_SECONDS`).
+
+### Fixed
+
+- A bond's address is checked the way `@orangecheck/bip322` checks it,
+  checksum included, so a mistyped address is `bond_malformed` here as in
+  TypeScript rather than `sig_invalid`.
+
+## [2.1.0] — 2026-10-16
+
+### Added — bonds (oc-attest-protocol `BOND.md`)
+
+- `BondFields`, `build_bond_message`, `parse_bond_message`, `bond_id`,
+  `bond_nullifier`, `bond_floors`, `verify_bond_signature`: the same message,
+  id, nullifier and floors as `@orangecheck/sdk` 1.12, held to the spec's
+  vectors `tv24`–`tv28`. Bond signatures verify through the `[verify]` extra,
+  an implementation independent of the TypeScript one.
+
 ## [2.0.0] — 2026-10-08
 
 `orangecheck.pledge` now matches `@orangecheck/pledge-core` 3.1 on who may

{orangecheck-2.0.0 → orangecheck-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: orangecheck
-Version: 2.0.0
+Version: 2.2.0
 Summary: Python SDK for OrangeCheck — proof of Bitcoin stake + the OC Pledge primitive (commitments) for the open web.
 Project-URL: Homepage, https://ochk.io
 Project-URL: Documentation, https://ochk.io/docs

{orangecheck-2.0.0 → orangecheck-2.2.0}/orangecheck/__init__.py

@@ -41,6 +41,18 @@ try:
     from .verify_sig import verify_bip322_signature
 except ImportError:  # pragma: no cover - optional-dep path
     verify_bip322_signature = None  # type: ignore[assignment]
+from .bond import (
+    BOND_DAYS_FLOORS,
+    BOND_MAX_WINDOW_SECONDS,
+    BOND_SATS_FLOORS,
+    BondFields,
+    bond_floors,
+    bond_id,
+    bond_nullifier,
+    build_bond_message,
+    parse_bond_message,
+    verify_bond_signature,
+)
 from .client import AsyncClient, Client
 from .errors import OrangeCheckError, RateLimitError, VerificationError
 from .top_level import challenge_issue, challenge_verify, check, discover, verify
@@ -76,6 +88,17 @@ __all__ = [
     # the name is re-exported as None when the extra isn't installed so callers
     # can check `if verify_bip322_signature is not None`).
     "verify_bip322_signature",
+    # Bonds (oc-attest-protocol BOND.md): one coin backing one subject
+    "BondFields",
+    "build_bond_message",
+    "parse_bond_message",
+    "bond_id",
+    "bond_nullifier",
+    "bond_floors",
+    "verify_bond_signature",
+    "BOND_SATS_FLOORS",
+    "BOND_DAYS_FLOORS",
+    "BOND_MAX_WINDOW_SECONDS",
     # Types
     "CheckResult",
     "VerifyOutcome",
@@ -90,7 +113,7 @@ __all__ = [
     "VerificationError",
 ]
 
-__version__ = "2.0.0"
+__version__ = "2.2.0"
 
 # OC Pledge submodule — sibling primitive for forward-looking commitments
 # bound to a Bitcoin address. Imported here so consumers can write:

orangecheck-2.2.0/orangecheck/bond.py

@@ -0,0 +1,226 @@
+"""
+Bonds (oc-attest-protocol BOND.md): one unspent coin backing one subject.
+The coin stays in its holder's wallet; spending it ends the bond. An audience
+sees floors and a keyed per-audience nullifier, never the coin.
+
+The message, id, nullifier and floors are pure and need nothing installed.
+``verify_bond_signature`` needs the ``[verify]`` extra for BIP-322. Checking
+the coin itself (unspent, confirmed, at the address) is chain state: read it
+from a node or an Esplora API you trust and compare it the way BOND.md §3.5
+says.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import re
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Optional
+
+HEADER = "orangecheck-bond"
+ACK = "I back this subject with this coin. It stays in my wallet."
+FIELDS = ("address", "outpoint", "subject", "nonce", "issued_at", "expires_at")
+
+#: Value floors a bond claim reports, in sats (BOND.md §5).
+BOND_SATS_FLOORS = (1_000, 10_000, 100_000, 1_000_000, 10_000_000)
+#: Age floors a bond claim reports, in days of 144 blocks (BOND.md §5).
+BOND_DAYS_FLOORS = (7, 30, 90, 365)
+#: The longest signing window a verifier accepts by default, in seconds (BOND.md §2).
+BOND_MAX_WINDOW_SECONDS = 3600
+
+_OUTPOINT = re.compile(r"^[0-9a-f]{64}:(0|[1-9][0-9]{0,9})$")
+_NONCE = re.compile(r"^[0-9a-f]{32}$")
+_TIME = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$")
+_SUBJECT = re.compile(r"^[\x21-\x7e]{1,256}$")
+
+_BECH32 = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+_BECH32M_CONST = 0x2BC830A3
+_B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+_B58_VERSIONS = (0x00, 0x05, 0x6F, 0xC4)
+
+
+def _polymod(values: list[int]) -> int:
+    gen = (0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3)
+    chk = 1
+    for v in values:
+        top = chk >> 25
+        chk = (chk & 0x1FFFFFF) << 5 ^ v
+        for i in range(5):
+            chk ^= gen[i] if ((top >> i) & 1) else 0
+    return chk
+
+
+def _five_to_eight(words: list[int]) -> Optional[bytes]:
+    """BIP-173 regrouping with strict padding: None when the padding is wrong."""
+    acc = bits = 0
+    out = bytearray()
+    for w in words:
+        acc = (acc << 5) | w
+        bits += 5
+        while bits >= 8:
+            bits -= 8
+            out.append((acc >> bits) & 0xFF)
+    if bits >= 5 or (acc << (8 - bits)) & 0xFF:
+        return None
+    return bytes(out)
+
+
+def _segwit_ok(address: str, hrp: str) -> bool:
+    if len(address) > 90 or address.lower() != address:
+        return False
+    sep = address.rfind("1")
+    if address[:sep] != hrp or len(address) - sep < 8:
+        return False
+    try:
+        data = [_BECH32.index(c) for c in address[sep + 1 :]]
+    except ValueError:
+        return False
+    const = _polymod([ord(c) >> 5 for c in hrp] + [0] + [ord(c) & 31 for c in hrp] + data)
+    words = data[:-6]
+    if not words:
+        return False
+    program = _five_to_eight(words[1:])
+    if program is None:
+        return False
+    if words[0] == 0:
+        return const == 1 and len(program) in (20, 32)
+    if words[0] == 1:
+        return const == _BECH32M_CONST and len(program) == 32
+    return False
+
+
+def _base58_ok(address: str) -> bool:
+    n = 0
+    for c in address:
+        i = _B58.find(c)
+        if i < 0:
+            return False
+        n = n * 58 + i
+    raw = b"\0" * (len(address) - len(address.lstrip("1"))) + n.to_bytes((n.bit_length() + 7) // 8, "big")
+    payload, check = raw[:-4], raw[-4:]
+    if len(payload) != 21 or payload[0] not in _B58_VERSIONS:
+        return False
+    return hashlib.sha256(hashlib.sha256(payload).digest()).digest()[:4] == check
+
+
+def _address_ok(address: str) -> bool:
+    """An address @orangecheck/bip322's decodeAddress accepts, checksum included."""
+    m = re.match(r"^(bc|tb|bcrt)1", address)
+    return _segwit_ok(address, m.group(1)) if m else _base58_ok(address)
+
+
+@dataclass(frozen=True)
+class BondFields:
+    address: str
+    outpoint: str
+    subject: str
+    nonce: str
+    issued_at: str
+    expires_at: str
+
+
+def _when(s: str) -> datetime:
+    # strptime refuses times that roll over, such as T24:00:00Z or February 30.
+    return datetime.strptime(s, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc)
+
+
+def _well_formed(f: BondFields) -> bool:
+    return bool(
+        _address_ok(f.address)
+        and _OUTPOINT.match(f.outpoint)
+        and _SUBJECT.match(f.subject)
+        and _NONCE.match(f.nonce)
+        and _TIME.match(f.issued_at)
+        and _TIME.match(f.expires_at)
+        and _when(f.expires_at) > _when(f.issued_at)
+    )
+
+
+def build_bond_message(fields: BondFields) -> str:
+    """The exact text the holder signs (BOND.md §2)."""
+    if not _well_formed(fields):
+        raise ValueError("bond fields are malformed")
+    lines = [HEADER] + [f"{k}: {getattr(fields, k)}" for k in FIELDS] + [f"ack: {ACK}"]
+    return "\n".join(lines) + "\n"
+
+
+def parse_bond_message(message: str) -> Optional[BondFields]:
+    """The fields of a well-formed bond message, or None. Strict: §2 or nothing."""
+    if not message.endswith("\n") or "\r" in message:
+        return None
+    lines = message[:-1].split("\n")
+    if len(lines) != len(FIELDS) + 2 or lines[0] != HEADER or lines[-1] != f"ack: {ACK}":
+        return None
+    values = {}
+    for i, key in enumerate(FIELDS):
+        prefix = f"{key}: "
+        if not lines[i + 1].startswith(prefix):
+            return None
+        values[key] = lines[i + 1][len(prefix):]
+    fields = BondFields(**values)
+    try:
+        return fields if _well_formed(fields) and build_bond_message(fields) == message else None
+    except ValueError:
+        return None
+
+
+def bond_id(message: str) -> str:
+    """SHA-256 of the message bytes, lowercase hex (BOND.md §2)."""
+    return hashlib.sha256(message.encode("utf-8")).hexdigest()
+
+
+def bond_nullifier(key: bytes, audience: str, outpoint: str) -> str:
+    """
+    The per-audience nullifier for a coin (BOND.md §6), keyed with a secret only
+    the registry holds. Unkeyed, an audience could hash every unspent output and
+    find the coin.
+    """
+    if len(key) < 32:
+        raise ValueError("bond nullifier key must be at least 32 bytes")
+    data = f"orangecheck-bond-nullifier\n{audience}\n{outpoint}".encode("utf-8")
+    return hmac.new(key, data, hashlib.sha256).hexdigest()
+
+
+def bond_floors(sats: int, age_blocks: int) -> dict[str, int]:
+    """The largest floor each value meets, 0 when it meets none (BOND.md §5)."""
+    days = age_blocks // 144
+    return {
+        "sats_floor": max((f for f in BOND_SATS_FLOORS if sats >= f), default=0),
+        "days_floor": max((f for f in BOND_DAYS_FLOORS if days >= f), default=0),
+    }
+
+
+def verify_bond_signature(
+    message: str,
+    signature: str,
+    *,
+    subject: Optional[str] = None,
+    now: Optional[datetime] = None,
+    skew_seconds: int = 60,
+    max_window_seconds: int = BOND_MAX_WINDOW_SECONDS,
+) -> tuple[bool, str]:
+    """
+    Check a signed bond message: shape, subject, signing window, signature.
+    Returns ``(True, bond_id)`` or ``(False, reason)`` with BOND.md's reason
+    codes. Requires the ``[verify]`` extra for the signature.
+    """
+    from .verify_sig import verify_bip322_signature
+
+    fields = parse_bond_message(message)
+    if fields is None:
+        return False, "bond_malformed"
+    if subject is not None and fields.subject != subject:
+        return False, "bond_subject_mismatch"
+    window = (_when(fields.expires_at) - _when(fields.issued_at)).total_seconds()
+    if window > max_window_seconds:
+        return False, "bond_window_too_long"
+    at = (now or datetime.now(timezone.utc)).timestamp()
+    if _when(fields.issued_at).timestamp() - skew_seconds > at:
+        return False, "bond_not_yet_valid"
+    if _when(fields.expires_at).timestamp() + skew_seconds < at:
+        return False, "bond_expired"
+    if not verify_bip322_signature(fields.address, message, signature):
+        return False, "sig_invalid"
+    return True, bond_id(message)

{orangecheck-2.0.0 → orangecheck-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "orangecheck"
-version = "2.0.0"
+version = "2.2.0"
 description = "Python SDK for OrangeCheck — proof of Bitcoin stake + the OC Pledge primitive (commitments) for the open web."
 readme = "README.md"
 license = { text = "MIT" }

orangecheck-2.2.0/tests/test_bond_address.py

@@ -0,0 +1,34 @@
+"""
+A bond's address is read the way @orangecheck/bip322's decodeAddress reads it,
+checksum included, so both SDKs give the same reason for the same message.
+The verdicts below were produced by that function.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from orangecheck.bond import _address_ok
+
+TS_VERDICTS = [
+    ("bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4", True),
+    ("bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t5", False),
+    ("BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4", False),
+    ("bc1pmfr3p9j00pfxjh0zmgp99y8zftmd3s5pmedqhyptwy6lm87hf5sspknck9", True),
+    ("bc1qrp33g0q5c5txsp9arysrx4k6zdkfs4nce4xj0gdcccefvpysxf3qccfmv3", True),
+    ("tb1qw508d6qejxtdg4y5r3zarvary0c5xw7kxpjzsx", True),
+    ("1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2", True),
+    ("1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN3", False),
+    ("3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy", True),
+    # Valid checksums over bad padding (v0 and v1).
+    ("bc1qlllllllllllllllllllllllllllllllllp3sej9", False),
+    ("bc1plllllllllllllllllllllllllllllllllllllllllllllllllllllnjr3m8", False),
+    # bech32m on a v0 program, and witness version 2.
+    ("bc1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqs9wcxj", False),
+    ("bc1zqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqupf6cj", False),
+]
+
+
+@pytest.mark.parametrize("address,ok", TS_VERDICTS)
+def test_address_agrees_with_typescript(address: str, ok: bool) -> None:
+    assert _address_ok(address) is ok

{orangecheck-2.0.0 → orangecheck-2.2.0}/tests/test_conformance.py

@@ -136,6 +136,63 @@ def test_bip322_signature(vector: dict) -> None:
     )
 
 
+# ─── bonds (BOND.md) ───────────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize("vector", vectors_of("bond_message"), ids=ids_for("bond_message"))
+def test_bond_message(vector: dict) -> None:
+    """The same eight lines and the same id as the TypeScript SDK."""
+    from orangecheck import BondFields, bond_id, build_bond_message, parse_bond_message
+
+    fields = BondFields(**vector["input"])
+    msg = build_bond_message(fields)
+    assert msg == vector["expected"]["canonical"]
+    assert bond_id(msg) == vector["expected"]["bond_id"]
+    assert parse_bond_message(msg) == fields
+
+
+@pytest.mark.parametrize("vector", vectors_of("bond_nullifier"), ids=ids_for("bond_nullifier"))
+def test_bond_nullifier(vector: dict) -> None:
+    from orangecheck import bond_nullifier
+
+    inp = vector["input"]
+    key = bytes.fromhex(inp["key"])
+    got = [bond_nullifier(key, a, inp["outpoint"]) for a in inp["audiences"]]
+    assert got == vector["expected"]["nullifiers"]
+
+
+@pytest.mark.parametrize("vector", vectors_of("bond_floors"), ids=ids_for("bond_floors"))
+def test_bond_floors(vector: dict) -> None:
+    from orangecheck import bond_floors
+
+    got = [bond_floors(c["sats"], c["age_blocks"]) for c in vector["input"]["cases"]]
+    assert got == vector["expected"]["floors"]
+
+
+@pytest.mark.parametrize("vector", vectors_of("bond_signature"), ids=ids_for("bond_signature"))
+def test_bond_signature(vector: dict) -> None:
+    from datetime import datetime
+
+    from orangecheck import verify_bip322_signature, verify_bond_signature
+
+    if verify_bip322_signature is None:
+        pytest.skip("install orangecheck[verify] to exercise bond signature vectors")
+
+    def at(s: str) -> datetime:
+        return datetime.fromisoformat(s.replace("Z", "+00:00"))
+
+    inp = vector["input"]
+    for i, b in enumerate(inp.get("bonds", [])):
+        ok, got = verify_bond_signature(b["message"], b["signature"], now=at(inp["now"]))
+        assert ok, got
+        assert got == vector["expected"]["bond_ids"][i]
+    for c in inp.get("cases", []):
+        assert verify_bond_signature(c["message"], c["signature"], now=at(c["now"])) == (
+            False,
+            c["reason"],
+        )
+
+
 # ─── Cross-impl meta-check ─────────────────────────────────────────────────
 
 
@@ -150,5 +207,9 @@ def test_vector_set_complete() -> None:
         "score_v0",
         "reject",
         "bip322_signature",
+        "bond_message",
+        "bond_signature",
+        "bond_nullifier",
+        "bond_floors",
     }
-    assert len(VECTORS) >= 23
+    assert len(VECTORS) >= 28

{orangecheck-2.0.0 → orangecheck-2.2.0}/tests/vectors/index.json

@@ -113,5 +113,30 @@
     "id": "tv23",
     "category": "bip322_signature",
     "description": "tampered signature (1 byte flipped) on an otherwise-valid tv21 payload — MUST NOT verify"
+  },
+  {
+    "id": "tv24",
+    "category": "bond_message",
+    "description": "bond message and its id (BOND.md §2)"
+  },
+  {
+    "id": "tv25",
+    "category": "bond_signature",
+    "description": "P2WPKH and P2TR bond signatures by private key 1, inside the signing window"
+  },
+  {
+    "id": "tv26",
+    "category": "bond_signature",
+    "description": "wrong signer, expired window, window over an hour, rolled-over time — MUST NOT verify"
+  },
+  {
+    "id": "tv27",
+    "category": "bond_nullifier",
+    "description": "one coin, two audiences, one registry key (BOND.md §6)"
+  },
+  {
+    "id": "tv28",
+    "category": "bond_floors",
+    "description": "floors instead of amount and age (BOND.md §5)"
   }
 ]

orangecheck-2.2.0/tests/vectors/tv24.json

@@ -0,0 +1,17 @@
+{
+  "id": "tv24",
+  "category": "bond_message",
+  "description": "bond message and its id (BOND.md §2)",
+  "input": {
+    "address": "bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4",
+    "outpoint": "1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0",
+    "subject": "did:oc:0123456789abcdef0123456789abcdef",
+    "nonce": "00112233445566778899aabbccddeeff",
+    "issued_at": "2026-10-16T12:00:00Z",
+    "expires_at": "2026-10-16T12:10:00Z"
+  },
+  "expected": {
+    "canonical": "orangecheck-bond\naddress: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T12:10:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+    "bond_id": "c4a9465c3b161eccb18c479649ef93149ac38124def8c3b9c7552bb1915d129e"
+  }
+}

orangecheck-2.2.0/tests/vectors/tv25.json

@@ -0,0 +1,27 @@
+{
+  "id": "tv25",
+  "category": "bond_signature",
+  "description": "P2WPKH and P2TR bond signatures by private key 1 (public, holds nothing), checked inside the signing window",
+  "input": {
+    "now": "2026-10-16T12:05:00Z",
+    "bonds": [
+      {
+        "address": "bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4",
+        "message": "orangecheck-bond\naddress: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T12:10:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+        "signature": "AkcwRAIgBtorUyg37InmZ8kY9+iWo7557g2YD5VsH0M+yHZke9wCIG0cnfgU0o+HXaTD1Tf7/uLi6+XWGpX32wMqIaHSNzxrASECeb5mfvncu6xVoGKVzocLBwKb/NstzijZWfKBWxb4F5g="
+      },
+      {
+        "address": "bc1pmfr3p9j00pfxjh0zmgp99y8zftmd3s5pmedqhyptwy6lm87hf5sspknck9",
+        "message": "orangecheck-bond\naddress: bc1pmfr3p9j00pfxjh0zmgp99y8zftmd3s5pmedqhyptwy6lm87hf5sspknck9\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T12:10:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+        "signature": "AUHt6fHusZm0RTxT2rmOw/1lDkfxgzIANvN+V1K0/llB3JXApVUlzYZhC8Er3bQo6OKluAIvF/wDUKG43PvZZMnUAQ=="
+      }
+    ]
+  },
+  "expected": {
+    "valid": true,
+    "bond_ids": [
+      "c4a9465c3b161eccb18c479649ef93149ac38124def8c3b9c7552bb1915d129e",
+      "5f7e7b49acab0088da4ef49b9b95a69ea5970190bf63659e3728b821efaa72a5"
+    ]
+  }
+}

orangecheck-2.2.0/tests/vectors/tv26.json

@@ -0,0 +1,36 @@
+{
+  "id": "tv26",
+  "category": "bond_signature",
+  "description": "the P2TR signature over the P2WPKH message MUST NOT verify; the P2WPKH bond after its window MUST be refused; a window over an hour MUST be refused even with a good signature; a time that rolls over (T24:00:00Z) is malformed",
+  "input": {
+    "cases": [
+      {
+        "now": "2026-10-16T12:05:00Z",
+        "message": "orangecheck-bond\naddress: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T12:10:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+        "signature": "AUHt6fHusZm0RTxT2rmOw/1lDkfxgzIANvN+V1K0/llB3JXApVUlzYZhC8Er3bQo6OKluAIvF/wDUKG43PvZZMnUAQ==",
+        "reason": "sig_invalid"
+      },
+      {
+        "now": "2026-10-16T12:20:00Z",
+        "message": "orangecheck-bond\naddress: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T12:10:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+        "signature": "AkcwRAIgBtorUyg37InmZ8kY9+iWo7557g2YD5VsH0M+yHZke9wCIG0cnfgU0o+HXaTD1Tf7/uLi6+XWGpX32wMqIaHSNzxrASECeb5mfvncu6xVoGKVzocLBwKb/NstzijZWfKBWxb4F5g=",
+        "reason": "bond_expired"
+      },
+      {
+        "now": "2026-10-16T12:05:00Z",
+        "message": "orangecheck-bond\naddress: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T14:00:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+        "signature": "AkcwRAIgCY8Rm6wdrZkbtup43Hjii70g+Hl1byYAVM+Z0405buACIAaE+P2t5Y9dH1fb9nCC3E8CrDVqEMi3j65l4Dh6UZMNASECeb5mfvncu6xVoGKVzocLBwKb/NstzijZWfKBWxb4F5g=",
+        "reason": "bond_window_too_long"
+      },
+      {
+        "now": "2026-10-16T12:05:00Z",
+        "message": "orangecheck-bond\naddress: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4\noutpoint: 1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0\nsubject: did:oc:0123456789abcdef0123456789abcdef\nnonce: 00112233445566778899aabbccddeeff\nissued_at: 2026-10-16T12:00:00Z\nexpires_at: 2026-10-16T24:00:00Z\nack: I back this subject with this coin. It stays in my wallet.\n",
+        "signature": "AkcwRAIgSem/l3mNW3RuBevxUME7srZm4mY+iBVDwwGTLyz9VD4CIGERr4Ro/HGqOivXJvUatJcp0BgbOsJ+tf2fgqsKwEfIASECeb5mfvncu6xVoGKVzocLBwKb/NstzijZWfKBWxb4F5g=",
+        "reason": "bond_malformed"
+      }
+    ]
+  },
+  "expected": {
+    "valid": false
+  }
+}

orangecheck-2.2.0/tests/vectors/tv27.json

@@ -0,0 +1,19 @@
+{
+  "id": "tv27",
+  "category": "bond_nullifier",
+  "description": "one coin, two audiences, one registry key: the same input gives the same nullifier, different audiences unrelated ones (BOND.md §6). The key is a public test key; a registry keeps its own secret.",
+  "input": {
+    "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+    "outpoint": "1bd631f9d28188be398bae26c018e93ec4d276d25d8f969b6cbc28eab13686c9:0",
+    "audiences": [
+      "https://example.com",
+      "https://ochk.app"
+    ]
+  },
+  "expected": {
+    "nullifiers": [
+      "f9f4ac1b66f2244dfd1ba70f2a8291bdf98e5aad5d7d828d79fbd7a4d188a755",
+      "a927f6884c62e98fe5802588d026d0a041b6c8f30cea817126daae965780531e"
+    ]
+  }
+}

orangecheck-2.2.0/tests/vectors/tv28.json

@@ -0,0 +1,53 @@
+{
+  "id": "tv28",
+  "category": "bond_floors",
+  "description": "floors an audience sees instead of amount and age (BOND.md §5); age in blocks, 144 per day",
+  "input": {
+    "cases": [
+      {
+        "sats": 999,
+        "age_blocks": 57600
+      },
+      {
+        "sats": 7397,
+        "age_blocks": 50256
+      },
+      {
+        "sats": 150000,
+        "age_blocks": 4320
+      },
+      {
+        "sats": 150000,
+        "age_blocks": 4319
+      },
+      {
+        "sats": 25000000,
+        "age_blocks": 6
+      }
+    ]
+  },
+  "expected": {
+    "floors": [
+      {
+        "sats_floor": 0,
+        "days_floor": 365
+      },
+      {
+        "sats_floor": 1000,
+        "days_floor": 90
+      },
+      {
+        "sats_floor": 100000,
+        "days_floor": 30
+      },
+      {
+        "sats_floor": 100000,
+        "days_floor": 7
+      },
+      {
+        "sats_floor": 10000000,
+        "days_floor": 0
+      }
+    ]
+  }
+}