proofbundle 3.8.0__tar.gz → 4.0.0__tar.gz

{proofbundle-3.8.0/src/proofbundle.egg-info → proofbundle-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.8.0
+Version: 4.0.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT

{proofbundle-3.8.0 → proofbundle-4.0.0}/docs/readiness_pack/AUDITOR_OPEN_POINTS.md

@@ -46,9 +46,10 @@ internal gate (see `REPRODUCTION_RUNBOOK.md`) is a precondition for this review,
 
 ## F. The one remaining gate to stable
 
-The single deliberately-open acceptance criterion is "external audit completed". 4.0.0-stable = this
-pack + the external audit ABSCHLUSS + findings closed/accepted + relation wire-freeze. Nothing in this
-repository can flip that bit; only the external reviewer can.
+The single deliberately-open acceptance criterion is "external audit completed". That trustworthy stable
+state = this pack + the external audit ABSCHLUSS + findings closed/accepted + relation wire-freeze. It is
+defined by those facts, not by a version number — the audit is decoupled from the version line and
+carries no version label. Nothing in this repository can flip that bit; only the external reviewer can.
 
 ## G. Known limitations of the audit-candidate matrix instrument itself (No-Fake, self-declared)
 

{proofbundle-3.8.0 → proofbundle-4.0.0}/docs/readiness_pack/MANIFEST.sha256

@@ -1,6 +1,6 @@
-e6e2f1ca00c1798975005315172248db3ee8fefb02b978cd12627c526dd5dc60  AUDITOR_OPEN_POINTS.md
+c9118da583581c150090ddeef9932b8082690a8854320f41a553a3dc60835ed1  AUDITOR_OPEN_POINTS.md
 3d66a85ff79c0258d794e7c8d8740f8a3b7a62e6ffd9bd7dada158a939964660  OPEN_QUESTIONS.md
-f9079c57df7b037f3c4a30137c5305de42c46cb12bf1c620f6ea5ce1b7c42c82  PROGRESS.md
+90644ce0e08fdecb8f3076b1b0121b490dbb0ba57e03e9dd700c83d3f785e1a5  PROGRESS.md
 6ccab20c7daef6d71c13e0dcacba24a6a18dd480b5d41418e01b5bf2983ffc9c  README.md
 c9ceb3f92a2f720d901affa8defb47004b58a51029317208db641ce53d90b284  REPRODUCTION_RUNBOOK.md
 1b4e4316aaea6c962664fc08945c65a048147fdc4ad89a1e694818b934ef6fa2  calendar_independence.md

{proofbundle-3.8.0 → proofbundle-4.0.0}/docs/readiness_pack/PROGRESS.md

@@ -1,8 +1,10 @@
 # Honest progress accounting (No-Overclaim)
 
-The denominator is the full distance from the 3.3.0 baseline (current release: 3.8.0) to "4.0.0-stable, externally audited,
-trustworthy". This is a factual progress statement, not a forward promise, and it is deliberately
-placed in the readiness pack so an auditor reads our own honest number before forming theirs.
+The denominator is the full distance from the 3.3.0 baseline (current release: 4.0.0) to the externally
+audited, trustworthy state. That state is defined by audit completion and closed findings, not by any
+version number — the audit is decoupled from the version line and happens when maturity is reached,
+whatever version is current then. This is a factual progress statement, not a forward promise, and it is
+deliberately placed in the readiness pack so an auditor reads our own honest number before forming theirs.
 
 ## Achievable in advance (internal, machine-checkable, no external party): ~85%
 
@@ -21,7 +23,7 @@ placed in the readiness pack so an auditor reads our own honest number before fo
   reviewer such as Loek; in-toto maintainer guidance; first outside users). Our side is preparable;
   the other side is not.
 - **~2% irreducible ceiling** (a full TEE-attestation path, whole-program verification, side-channel
-  freedom) — deliberately outside 4.0.0, a permanent external/research remainder.
+  freedom) — deliberately outside the audit scope, a permanent external/research remainder.
 
 ## Consequence
 

{proofbundle-3.8.0 → proofbundle-4.0.0}/docs/readiness_pack/proofbundle/readiness_pack.bundle.json

@@ -1,16 +1,16 @@
 {
   "schema": "proofbundle/v0.1",
-  "payload_b64": "ZTZlMmYxY2EwMGMxNzk4OTc1MDA1MzE1MTcyMjQ4ZGIzZWU4ZmVmYjAyYjk3OGNkMTI2MjdjNTI2ZGQ1ZGM2MCAgQVVESVRPUl9PUEVOX1BPSU5UUy5tZAozZDY2YTg1ZmY3OWMwMjU4ZDc5NGU3YzhkODc0MGY4YTNiN2E2MmU2ZmZkOWJkN2RhZGExNThhOTM5OTY0NjYwICBPUEVOX1FVRVNUSU9OUy5tZApmOTA3OWM1N2RmN2IwMzdmM2M0YTMwMTM3YzUzMDVkZTQyYzQ2Y2IxMmJmMWM2MjBmNmVhNWNlMWI3YzQyYzgyICBQUk9HUkVTUy5tZAo2Y2NhYjIwYzdkYWVmNmQ3MWMxM2UwZGNhY2JhMjRhNmExOGRkNDgwYjVkNDE0MThlMDFiNWJmMjk4M2ZmYzljICBSRUFETUUubWQKYzljZWIzZjkyYTJmNzIwZDkwMWFmZmE4ZGVmYjQ3MDA0YjU4YTUxMDI5MzE3MjA4ZGI2NDFjZTUzZDkwYjI4NCAgUkVQUk9EVUNUSU9OX1JVTkJPT0subWQKMWI0ZTQzMTZhYWVhNmM5NjI2NjRmYzA4OTQ1YzY1YTA0ODE0N2ZkYzRhZDg5YTFlNjk0ODE4YjkzNGVmNmZhMiAgY2FsZW5kYXJfaW5kZXBlbmRlbmNlLm1kCjlhOWE5ZTQ5NTYwNzZjNmMyODdkYWRhNWRlODJlYjY2Y2YyNTljZWM4OWE2ZTc5MTA4OGUxNzMzYTc0YzVlYTMgIGRpZmZlcmVudGlhbF9tYXRyaXgubWQKNDI2YTIyYmQ5MWM3YTc1Mjk3MDBjMDY1NzBhM2U1NWZiNGMxMTI4MTk5MmQ2MjE1ZmMyMzE1YjEyNzMxZjljZCAgaW5kZXguanNvbgpkMWQxZTA0ZTlkMmRlMzg0NDNlYzJiOTUzYzNhOWM5NjhhMzAzZTgxOTc3Y2I3ZTEyODQ2ODk0NTE2MGI1NmQ3ICBydXN0X3Bhcml0eV9zY29wZS5tZApmMmE3N2NhY2Q3ZmVmZTM5NDUwZWRiMTg1N2VjMmZmYzI1YTRkNGMzZDhkNjhlZmEwOTRiYTg0YWI3MzI1NzA4ICB0YW1wZXJfcmVzaXN0YW5jZS5tZAo2ZDZhNDA2NWExZTdlMDcxODE5OTYwY2VmOGUwMTE3YWRhOThlOTMxY2Q2MmZkOTQzNDFiNDVhZjQ4NjU3MTFhICB0aHJlYXRfbW9kZWxfZGVsdGFfMzYwLm1kCg==",
+  "payload_b64": "YzkxMThkYTU4MzU4MWMxNTAwOTBkZGVlZjk5MzJiODA4MjY5MGE4ODU0MzIwZjQxYTU1M2EzZGM2MDgzNWVkMSAgQVVESVRPUl9PUEVOX1BPSU5UUy5tZAozZDY2YTg1ZmY3OWMwMjU4ZDc5NGU3YzhkODc0MGY4YTNiN2E2MmU2ZmZkOWJkN2RhZGExNThhOTM5OTY0NjYwICBPUEVOX1FVRVNUSU9OUy5tZAo5MDY0NGNlMGUwOGZkZWNiOGYzMDc2YjFiMDEyMWI0OTBkYmIwYmE1N2UwM2U5ZGQ3MDBjODNkM2Y3ODVlMWE1ICBQUk9HUkVTUy5tZAo2Y2NhYjIwYzdkYWVmNmQ3MWMxM2UwZGNhY2JhMjRhNmExOGRkNDgwYjVkNDE0MThlMDFiNWJmMjk4M2ZmYzljICBSRUFETUUubWQKYzljZWIzZjkyYTJmNzIwZDkwMWFmZmE4ZGVmYjQ3MDA0YjU4YTUxMDI5MzE3MjA4ZGI2NDFjZTUzZDkwYjI4NCAgUkVQUk9EVUNUSU9OX1JVTkJPT0subWQKMWI0ZTQzMTZhYWVhNmM5NjI2NjRmYzA4OTQ1YzY1YTA0ODE0N2ZkYzRhZDg5YTFlNjk0ODE4YjkzNGVmNmZhMiAgY2FsZW5kYXJfaW5kZXBlbmRlbmNlLm1kCjlhOWE5ZTQ5NTYwNzZjNmMyODdkYWRhNWRlODJlYjY2Y2YyNTljZWM4OWE2ZTc5MTA4OGUxNzMzYTc0YzVlYTMgIGRpZmZlcmVudGlhbF9tYXRyaXgubWQKNDI2YTIyYmQ5MWM3YTc1Mjk3MDBjMDY1NzBhM2U1NWZiNGMxMTI4MTk5MmQ2MjE1ZmMyMzE1YjEyNzMxZjljZCAgaW5kZXguanNvbgpkMWQxZTA0ZTlkMmRlMzg0NDNlYzJiOTUzYzNhOWM5NjhhMzAzZTgxOTc3Y2I3ZTEyODQ2ODk0NTE2MGI1NmQ3ICBydXN0X3Bhcml0eV9zY29wZS5tZApmMmE3N2NhY2Q3ZmVmZTM5NDUwZWRiMTg1N2VjMmZmYzI1YTRkNGMzZDhkNjhlZmEwOTRiYTg0YWI3MzI1NzA4ICB0YW1wZXJfcmVzaXN0YW5jZS5tZAo2ZDZhNDA2NWExZTdlMDcxODE5OTYwY2VmOGUwMTE3YWRhOThlOTMxY2Q2MmZkOTQzNDFiNDVhZjQ4NjU3MTFhICB0aHJlYXRfbW9kZWxfZGVsdGFfMzYwLm1kCg==",
   "signature": {
     "alg": "ed25519",
-    "public_key_b64": "GB+LMY2k3nnr1Cm64iVJLLMdiEstoP4DGflIXXN2/2Q=",
-    "sig_b64": "sgKuvyQ1j477RZ2MARU89S9oiopJkI7yfwRjeyTRj1P6N3N5rCMAEyMwhVvN5vupfwDo/CaJO/dVdZs3VribAA=="
+    "public_key_b64": "nw4HE+7lk4peNaNMHeejmVYEANGW9WuR/GernA852JQ=",
+    "sig_b64": "HQiW4MHVH14fwTISNergEngB1pQqyQZBSg7O/mhymub0aoqz2Ls/7jKfWtM/piQxiUAd1WxlkgL9UjOwkC2SAQ=="
   },
   "merkle": {
     "hash_alg": "sha256-rfc6962",
     "leaf_index": 0,
     "tree_size": 1,
     "inclusion_proof_b64": [],
-    "root_b64": "jaW3qlMpoFggIW4V2uP4mdPOw3prJdMP0Mc6BXihy2o="
+    "root_b64": "oan5ljNnHVL4j/dVo1B5EIDeqMxF9w7AZmi7eaazKkk="
   }
 }

proofbundle-4.0.0/docs/readiness_pack/proofbundle/readiness_pack.pub.b64

@@ -0,0 +1 @@
+nw4HE+7lk4peNaNMHeejmVYEANGW9WuR/GernA852JQ=

{proofbundle-3.8.0 → proofbundle-4.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.8.0"
+version = "4.0.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"

{proofbundle-3.8.0 → proofbundle-4.0.0}/scripts/claims_hygiene_check.py

@@ -45,9 +45,10 @@ _DEFAULT_DOCS = [
     "docs/predicates/README.md", "docs/predicates/action-outcome.md", "docs/predicates/decision-receipt.md",
     "docs/predicates/run-ledger.md", "docs/predicates/trust-pack.md", "docs/predicates/verification-summary.md",
     "docs/SDJWT_VC_PROFILE.md", "docs/SUBJECT_BINDING.md",
-    # 3.6.0 audit-candidate readiness-pack reviewer docs (capability-claim genre, same discipline).
-    # PROGRESS.md is deliberately NOT here: it QUOTES the future goal "4.0.0-stable, externally audited"
-    # as an honest denominator, which the audit-candidate forbidden list would false-positive on.
+    # Audit-candidate readiness-pack reviewer docs (capability-claim genre, same discipline).
+    # PROGRESS.md is deliberately NOT here: it QUOTES the future goal "the externally audited, trustworthy
+    # state" as an honest denominator (version-free — the audit is decoupled from the version line, Owner
+    # 2026-08-17), which the audit-candidate forbidden list would false-positive on.
     "docs/readiness_pack/AUDITOR_OPEN_POINTS.md", "docs/readiness_pack/threat_model_delta_360.md",
     "docs/readiness_pack/rust_parity_scope.md", "docs/readiness_pack/differential_matrix.md",
     "docs/readiness_pack/REPRODUCTION_RUNBOOK.md",

{proofbundle-3.8.0 → proofbundle-4.0.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.8.0"
+__version__ = "4.0.0"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump

{proofbundle-3.8.0 → proofbundle-4.0.0}/src/proofbundle/anchors_rootcommit.py

@@ -156,7 +156,14 @@ def verify_rootcommit_v1(checkpoint_text: str, *, frozen: Optional[dict] = None,
         return {"known_anchors": known, "binding": False, "reject": True, "status": "bad_opaque",
                 "detail": "rootcommit/v1 opaque is not 0x01 || wlen || wallet || ots"}
     wallet, ots = parsed
-    commitment = hashlib.sha256(build_preimage(origin, size, root, wallet)).digest()
+    # DEEP-GATE re-gate F-8 neighbour: build_preimage encodes attacker-controlled checkpoint fields to
+    # UTF-8; a lone-surrogate origin/wallet would raise a raw UnicodeEncodeError out of this "never a raw
+    # exception" surface (docstring on _iter helper). Fail closed to the same malformed verdict instead.
+    try:
+        commitment = hashlib.sha256(build_preimage(origin, size, root, wallet)).digest()
+    except (UnicodeError, ValueError, TypeError):
+        return {"known_anchors": known, "binding": False, "reject": True, "status": "malformed_checkpoint",
+                "detail": "checkpoint field is not UTF-8 encodable (surrogate/non-encodable), fail-closed"}
     b = _binding_status(ots, commitment, frozen=frozen, rp_trust=rp_trust)
     bound = b["status"] not in ("unbound", "malformed", "no_lib")
     return {"known_anchors": known, "binding": bound, "reject": not bound,
@@ -250,7 +257,13 @@ def verify_rootcommit_v2sig(checkpoint_text: str, *, frozen: Optional[dict] = No
     if parsed is None:
         return {"known_anchors": known, "binding": False, "sig_ok": None, "reject": True, "status": "bad_opaque"}
     wallet, sig, ots = parsed
-    commitment = hashlib.sha256(build_preimage(origin, size, root, wallet, tag=TAG_V1)).digest()
+    # DEEP-GATE re-gate F-8 neighbour (as in verify_rootcommit_v1): fail closed on a non-encodable field.
+    try:
+        commitment = hashlib.sha256(build_preimage(origin, size, root, wallet, tag=TAG_V1)).digest()
+    except (UnicodeError, ValueError, TypeError):
+        return {"known_anchors": known, "binding": False, "sig_ok": None, "reject": True,
+                "status": "malformed_checkpoint",
+                "detail": "checkpoint field is not UTF-8 encodable (surrogate/non-encodable), fail-closed"}
     b = _binding_status(ots, commitment, frozen=frozen, rp_trust=rp_trust)
     bound = b["status"] not in ("unbound", "malformed", "no_lib")
     # signature: EIP-191 recover over (tag + '\n' + commitment_hex) must equal the bound wallet (dep-gated)

{proofbundle-3.8.0 → proofbundle-4.0.0}/src/proofbundle/checkpoint.py

@@ -49,20 +49,66 @@ def _root_std_b64(root: bytes) -> str:
     return base64.b64encode(root).decode("ascii")
 
 
+def _origin_wellformed(origin: str) -> bool:
+    """An origin / note identity safe for the EXACT origin-quorum compare: printable ASCII only, no '+'
+    (the vkey separator), no leading/trailing space and no double space. A single internal ASCII space
+    is allowed so Go sumdb's `go.sum database tree` verifies; a witness NAME carries no space at all
+    (enforced), so a spaced origin still cannot equal one.
+
+    Printable-ASCII is the POSITIVE, non-enumerated rule that closes the whole invisible/look-alike
+    CLASS at once, instead of chasing one Unicode category per round (Deep-Gate F-1 zero-width → re-gate
+    NBSP → re-gate variation-selectors/Default-Ignorable/appended-space). None of those can cloak an
+    origin into looking like a witness name it then escapes the exclusion under, because none is
+    printable ASCII: a zero-width (Cf), a Default_Ignorable letter (Hangul filler, category Lo), a
+    variation selector or combining mark (Mn), a NBSP or other non-plain whitespace (Zs), a control char
+    (Cc) — all rejected. Measured against every shipped external vector (Go sumdb, Rekor, rootcommit,
+    Colin's fixtures): all pass. Honest scope: this also refuses a non-ASCII (IDN/Unicode) origin, a
+    deliberate restriction for the verifier's identity compare; no real tlog origin is non-ASCII."""
+    # DEEP-GATE 4.0.0 re-gate iter5 (never-raise, caller-contract): a non-str origin (None/int/list from a
+    # caller that built it from an upstream JSON field) reached `.isascii()` and raised a raw AttributeError
+    # out of every public constructor/cosign surface that routes identity through this helper. Same
+    # isinstance(str) guard the parse helpers already carry — validate the TYPE before the content.
+    if not isinstance(origin, str):
+        return False
+    if not origin or "+" in origin:
+        return False
+    if not (origin.isascii() and origin.isprintable()):
+        return False
+    return origin == origin.strip() and "  " not in origin
+
+
+def _witness_name_wellformed(name: str) -> bool:
+    """A witness NAME safe for the exact compare: non-empty printable ASCII, no '+', no space at all
+    (a schemeless identity). Stricter than an origin, which allows internal spaces — the emit path
+    (cosign_checkpoint / _mldsa) always required this; :func:`_parse_witness_vkey` now enforces it on
+    the verify path too, so a name cloaked with any whitespace or invisible character cannot parse."""
+    return (isinstance(name, str) and bool(name) and "+" not in name and " " not in name
+            and name.isascii() and name.isprintable())
+
+
 def checkpoint_note(origin: str, tree_size: int, root: bytes) -> str:
     """Build the C2SP checkpoint note text (3 lines + trailing newline). ``root`` is the raw RFC 6962
     Merkle root bytes at ``tree_size``. ``origin`` must be non-empty with no spaces/'+' (a schemeless URL)."""
-    if not origin or "+" in origin or any(c.isspace() for c in origin):
-        raise BundleFormatError("checkpoint origin must be a non-empty schemeless id without whitespace or '+'")
+    if not _origin_wellformed(origin):
+        raise BundleFormatError("checkpoint origin must be a printable-ASCII schemeless id without "
+                                "edge/double spaces, invisible characters, or '+'")
     if isinstance(tree_size, bool) or not isinstance(tree_size, int) or tree_size < 0:
         raise BundleFormatError("checkpoint tree_size must be a non-negative integer")
+    if not isinstance(root, bytes):    # iter5 never-raise: a non-bytes root raised raw TypeError from b64encode
+        raise BundleFormatError("checkpoint root must be raw bytes")
     return f"{origin}\n{tree_size}\n{_root_std_b64(root)}\n"
 
 
 def key_id(keyname: str, pubkey: bytes) -> bytes:
     """C2SP note key ID = first 4 bytes of SHA-256(keyname ‖ 0x0A ‖ 0x01 ‖ 32-byte-Ed25519-pubkey)."""
-    if len(pubkey) != 32:
+    if not isinstance(pubkey, bytes) or len(pubkey) != 32:
         raise BundleFormatError("Ed25519 public key must be 32 raw bytes")
+    # DEEP-GATE re-gate F-8/F-10: the log key name is the third identity slot (with origin and witness
+    # name); it is encoded into the keyID, so a surrogate name would raise a raw UnicodeEncodeError
+    # out of this public helper, and a zero-width/invisible name would substitute for a real one.
+    # Same printable-ASCII rule as origin/witness name — closed at the source that does the encode.
+    if not _witness_name_wellformed(keyname):
+        raise BundleFormatError("key name must be a printable-ASCII identity without spaces or invisible characters")
     h = hashlib.sha256(keyname.encode("utf-8") + b"\n" + bytes([_ED25519_SIG_TYPE]) + pubkey).digest()
     return h[:4]
 
@@ -79,8 +125,9 @@ def sign_checkpoint(origin: str, tree_size: int, root: bytes, signer, keyname: s
     """Produce a signed C2SP checkpoint note. ``signer`` is an Ed25519 private key whose public key must
     correspond to ``keyname``. The signature is over the RAW note-text bytes (including the trailing
     newline), never over base64 and never PAE-wrapped."""
-    if not keyname or "+" in keyname or any(c.isspace() for c in keyname):
-        raise BundleFormatError("checkpoint keyname must be non-empty without whitespace or '+'")
+    if not _witness_name_wellformed(keyname):
+        raise BundleFormatError("checkpoint keyname must be a printable-ASCII identity "
+                                "without spaces, invisible characters, or '+'")
     note = checkpoint_note(origin, tree_size, root)
     pubkey = signer.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
     sig = signer.sign(note.encode("utf-8"))
@@ -103,6 +150,10 @@ def _parse_vkey(vkey_str: str, sig_type: int = _ED25519_SIG_TYPE) -> tuple[str,
     if len(parts) != 3:
         raise BundleFormatError("vkey must have 3 '+'-separated parts (name+hexKeyID+base64KeyMaterial)")
     name, kid_hex, keymat_b64 = parts
+    # DEEP-GATE re-gate F-8: the log vkey NAME is encoded into key_id below; a surrogate name would
+    # raise UnicodeEncodeError and an invisible one would substitute — same rule as the witness vkey.
+    if not _witness_name_wellformed(name):
+        raise BundleFormatError("vkey name must be a printable-ASCII identity without spaces or invisible characters")
     try:
         keymat = base64.b64decode(keymat_b64, validate=True)
     except (ValueError, TypeError) as exc:
@@ -145,17 +196,33 @@ def verify_checkpoint(signed_note: str, vkey_str: str) -> dict:
         raise BundleFormatError("signed note has no empty-line separator between text and signatures")
     note_text, sig_block = signed_note.split("\n\n", 1)
     note_text += "\n"                       # restore the trailing newline that belongs to the note text
-    note_bytes = note_text.encode("utf-8")
     lines = note_text.split("\n")
     if len(lines) < 4 or not lines[0] or not lines[1] or not lines[2]:
         raise BundleFormatError("checkpoint note must have at least 3 non-empty lines")
     origin, size_s, root_b64 = lines[0], lines[1], lines[2]
+    # DEEP-GATE F-1 + re-gate (2026-08-17): the origin must be a printable-ASCII identity with no
+    # edge/double space, so it cannot cloak a witness name it would then escape the origin-quorum
+    # exclusion under (via zero-width, Default-Ignorable, variation selector, NBSP or an appended
+    # space). Positive rule = the whole class, not one category per round. Go sumdb / Rekor stay valid.
+    if not _origin_wellformed(origin):
+        raise BundleFormatError("checkpoint origin must be a printable-ASCII identity without "
+                                "edge/double spaces, invisible characters, or '+' (malformed)")
     if len(size_s) > 20 or (size_s != "0" and (size_s.startswith("0") or not (size_s.isascii() and size_s.isdigit()))):
         raise BundleFormatError("checkpoint tree size must be ASCII decimal with no leading zeros")
     try:
         root = base64.b64decode(root_b64, validate=True)
     except (ValueError, TypeError) as exc:
         raise BundleFormatError("checkpoint root is not valid standard base64") from exc
+    # DEEP-GATE 4.0.0 re-gate (D2/D3): the note-text encode was ABOVE this block, so a lone/unpaired
+    # UTF-16 surrogate anywhere in the note (a str survives splitting but is not valid UTF-8) raised a
+    # raw UnicodeEncodeError out of verify_witnessed_checkpoint / evaluate_public_transparency — the one
+    # verify_checkpoint instance the F-8/F-10 validate-before-encode re-gates missed (verify_tlog_proof
+    # already wraps its call; the sibling _note_text_of already validates first). Encode AFTER the string
+    # validation, and fail-closed on any residual non-UTF-8 note text (e.g. a surrogate in an extension line).
+    try:
+        note_bytes = note_text.encode("utf-8")
+    except UnicodeEncodeError as exc:
+        raise BundleFormatError("checkpoint note text is not valid UTF-8 (malformed, fail-closed)") from exc
 
     ok = False
     # WAR DER SCHLUESSEL UEBERHAUPT DABEI? Diese Unterscheidung entsteht in der Schleife unten und
@@ -228,8 +295,14 @@ def root_bytes_from_b64(root_b64: str) -> Optional[bytes]:
 
 def cosign_key_id(witness_name: str, pubkey: bytes) -> bytes:
     """Cosignature/v1 key ID = SHA-256(name ‖ 0x0A ‖ 0x04 ‖ 32-byte-Ed25519-pubkey)[:4]."""
-    if len(pubkey) != 32:
+    if not isinstance(pubkey, bytes) or len(pubkey) != 32:
         raise BundleFormatError("Ed25519 public key must be 32 raw bytes")
+    # DEEP-GATE re-gate F-8/F-10: the witness name is the third identity slot (with origin and witness
+    # name); it is encoded into the keyID, so a surrogate name would raise a raw UnicodeEncodeError
+    # out of this public helper, and a zero-width/invisible name would substitute for a real one.
+    # Same printable-ASCII rule as origin/witness name — closed at the source that does the encode.
+    if not _witness_name_wellformed(witness_name):
+        raise BundleFormatError("witness name must be a printable-ASCII identity without spaces or invisible characters")
     h = hashlib.sha256(witness_name.encode("utf-8") + b"\n"
                        + bytes([_COSIG_V1_SIG_TYPE]) + pubkey).digest()
     return h[:4]
@@ -255,6 +328,37 @@ def _note_text_of(signed_note: str) -> str:
     lines = note_text.split("\n")
     if len(lines) < 4 or not lines[0] or not lines[1] or not lines[2]:
         raise BundleFormatError("checkpoint note must have at least 3 non-empty lines")
+    # DEEP-GATE F-1 + re-gate: reject a cloaked origin here too, so every consumer of the note body
+    # (verify_cosignature, witness_quorum's origin extraction) sees an exact-comparable identity.
+    if not _origin_wellformed(lines[0]):
+        raise BundleFormatError("checkpoint origin must be a printable-ASCII identity without "
+                                "edge/double spaces, invisible characters, or '+' (malformed)")
+    # DEEP-GATE 4.0.0 re-gate (D2/D3 CLASS fix): _origin_wellformed only checks lines[0]. The note body
+    # ALSO carries size, root and OPTIONAL C2SP extension lines (lines[3:]) that _cosigned_message encodes
+    # WHOLE — a lone/unpaired UTF-16 surrogate anywhere in it raised a raw UnicodeEncodeError out of the
+    # public verify_cosignature / evaluate_public_transparency / cosign_checkpoint surfaces. verify_checkpoint
+    # fixed the ordering for its OWN copy of the text; this shared cosignature-path parser is the neighbour
+    # instance the first cut missed. Validate the whole note body is UTF-8-safe here, once, for every consumer.
+    try:
+        note_text.encode("utf-8")
+    except UnicodeEncodeError as exc:
+        raise BundleFormatError("checkpoint note text is not valid UTF-8 (malformed, fail-closed)") from exc
+    # DEEP-GATE 4.0.0 re-gate iter4 (D2/D3 CLASS, third neighbour, found by a 4th adversarial pass):
+    # _note_text_of guaranteed only origin + UTF-8, NOT that line 1 is a uint64 decimal or line 2 valid
+    # base64. cosign_checkpoint_mldsa is the one consumer that does not RE-validate them (verify_checkpoint
+    # and verify_cosignature each do their own) — it fed the raw lines into int(size_s).to_bytes(8,"big") and
+    # base64.b64decode(validate=True), raising a raw ValueError / binascii.Error / OverflowError (incl. the
+    # CVE-2020-10735 integer-string DoS on a 5000-digit size) out of a public witness-signing surface.
+    # Validate the note-body fields here, once, for every consumer of the shared parser. The len<=20 test
+    # short-circuits before int(size_s), so an over-long digit string never reaches the (bounded) int parse.
+    size_s, root_b64 = lines[1], lines[2]
+    if len(size_s) > 20 or not (size_s.isascii() and size_s.isdigit()) \
+            or (size_s != "0" and size_s.startswith("0")) or int(size_s) >= 2 ** 64:
+        raise BundleFormatError("checkpoint tree size must be a uint64 ASCII decimal with no leading zeros")
+    try:
+        base64.b64decode(root_b64, validate=True)
+    except (ValueError, TypeError) as exc:
+        raise BundleFormatError("checkpoint root is not valid standard base64") from exc
     return note_text
 
 
@@ -275,8 +379,9 @@ def cosign_checkpoint(signed_note: str, witness_signer, witness_name: str, times
     if isinstance(timestamp, bool) or not isinstance(timestamp, int) \
             or not 0 <= timestamp <= _MAX_COSIG_TIMESTAMP:
         raise BundleFormatError("cosignature timestamp must be an integer in [0, 2^63-1]")
-    if not witness_name or "+" in witness_name or any(c.isspace() for c in witness_name):
-        raise BundleFormatError("witness name must be non-empty without spaces or '+'")
+    if not _witness_name_wellformed(witness_name):
+        raise BundleFormatError("witness name must be a printable-ASCII identity "
+                                "without spaces, invisible characters, or '+'")
     note_text = _note_text_of(signed_note)
     if not signed_note.endswith("\n"):
         raise BundleFormatError("signed note must end with a newline")
@@ -289,8 +394,14 @@ def cosign_checkpoint(signed_note: str, witness_signer, witness_name: str, times
 
 def cosign_key_id_mldsa(witness_name: str, pubkey: bytes) -> bytes:
     """ML-DSA-44 cosignature key ID = SHA-256(name ‖ 0x0A ‖ 0x06 ‖ 1312-byte pubkey)[:4]."""
-    if len(pubkey) != _MLDSA44_PUB_LEN:
+    if not isinstance(pubkey, bytes) or len(pubkey) != _MLDSA44_PUB_LEN:
         raise BundleFormatError("ML-DSA-44 public key must be 1312 raw bytes")
+    # DEEP-GATE re-gate F-8/F-10: the witness name is the third identity slot (with origin and witness
+    # name); it is encoded into the keyID, so a surrogate name would raise a raw UnicodeEncodeError
+    # out of this public helper, and a zero-width/invisible name would substitute for a real one.
+    # Same printable-ASCII rule as origin/witness name — closed at the source that does the encode.
+    if not _witness_name_wellformed(witness_name):
+        raise BundleFormatError("witness name must be a printable-ASCII identity without spaces or invisible characters")
     h = hashlib.sha256(witness_name.encode("utf-8") + b"\n"
                        + bytes([_COSIG_MLDSA_SIG_TYPE]) + pubkey).digest()
     return h[:4]
@@ -351,8 +462,9 @@ def cosign_checkpoint_mldsa(signed_note: str, witness_signer, witness_name: str,
     if isinstance(timestamp, bool) or not isinstance(timestamp, int) \
             or not 0 <= timestamp <= _MAX_COSIG_TIMESTAMP:
         raise BundleFormatError("cosignature timestamp must be an integer in [0, 2^63-1]")
-    if not witness_name or "+" in witness_name or any(c.isspace() for c in witness_name):
-        raise BundleFormatError("witness name must be non-empty without spaces or '+'")
+    if not _witness_name_wellformed(witness_name):
+        raise BundleFormatError("witness name must be a printable-ASCII identity "
+                                "without spaces, invisible characters, or '+'")
     note_text = _note_text_of(signed_note)
     if not signed_note.endswith("\n"):
         raise BundleFormatError("signed note must end with a newline")
@@ -379,6 +491,14 @@ def _parse_witness_vkey(vkey_str: str) -> tuple[str, bytes, bytes, int]:
     if len(parts) != 3:
         raise BundleFormatError("vkey must have 3 '+'-separated parts (name+hexKeyID+base64KeyMaterial)")
     name, kid_hex, keymat_b64 = parts
+    # DEEP-GATE re-gate (2026-08-17): a witness NAME must be a printable-ASCII identity with no
+    # space (the emit path always required this; enforced on the VERIFY path here too). A name
+    # cloaked with whitespace, a zero-width, a variation selector or a Default-Ignorable character
+    # would parse and verify, look identical to the origin, yet be byte-different, so the
+    # origin-quorum name compare would miss it and the log would vote under a cloaked name.
+    if not _witness_name_wellformed(name):
+        raise BundleFormatError(
+            "witness vkey name must be a printable-ASCII identity without spaces or invisible characters")
     try:
         keymat = base64.b64decode(keymat_b64, validate=True)
     except (ValueError, TypeError) as exc:
@@ -487,7 +607,25 @@ def _witness_key_material(vkey: str) -> bytes:
     return base64.b64decode(vkey.split("+", 2)[2])
 
 
-def witness_quorum(signed_note: str, witness_vkeys, threshold: int):
+def _log_key_material_of(log_vkey: str) -> "bytes | None":
+    """The raw public-key bytes of a LOG vkey (0x01), for the origin-quorum key-material exclusion
+    (DEEP-GATE F-2). Compared against a witness vkey's pubkey bytes WITHOUT the alg-type prefix, so a
+    log that reuses its 0x01 signing key as a 0x04 cosignature key is caught despite the differing
+    prefix. Defensive: a malformed log vkey yields None (the exclusion then falls back to the name
+    test), never a raise — on the real path verify_checkpoint already raised on a malformed log vkey."""
+    try:
+        _name, _kid, pubkey = _parse_vkey(log_vkey)
+        return pubkey
+    except (BundleFormatError, ValueError, TypeError):
+        # DEEP-GATE re-gate F-7: catch the BASE families, not just BundleFormatError — a lone-surrogate
+        # log-vkey name reaches key_id -> name.encode("utf-8") and raises UnicodeEncodeError (a
+        # ValueError), which would otherwise escape this "never a raise" helper and, through the new
+        # public_transparency call site, become a raw traceback out of a documented fail-closed surface.
+        return None
+
+
+def witness_quorum(signed_note: str, witness_vkeys, threshold: int, *,
+                   log_key_material: "bytes | None"):  # DEEP-GATE 4.0.0 D1: REQUIRED keyword (was `= None`)
     """Shared k-of-n witness quorum (release-review fix): counts DISTINCT witness KEY MATERIAL, not names —
     C2SP requires operators to use distinct keys per cosigner, so one physical key under N names is ONE witness.
     Alg-agnostic (Ed25519 0x04 + ML-DSA 0x06). Used by BOTH verify_witnessed_checkpoint AND tlogproof.
@@ -495,26 +633,85 @@ def witness_quorum(signed_note: str, witness_vkeys, threshold: int):
     (witnesses_ok, witnesses_dict); the dict is keyed by name+keyID so a same-name-different-key entry does not
     overwrite. Fail-closed: an unparseable witness vkey raises (verify_cosignature); a non-verifying one is
     False; and a witness whose algorithm this build cannot verify (an ML-DSA vkey without the [pq] extra) also
-    counts as non-verifying (False), never a raw UnsupportedError out of the batch (adversarial re-audit round 5)."""
+    counts as non-verifying (False), never a raw UnsupportedError out of the batch (adversarial re-audit round 5).
+
+    ORIGIN-QUORUM RULE — a log never votes in its own quorum. A witness cosignature is EXCLUDED from
+    the count (``ok=False``, ``origin_excluded=True``, before any signature math) when EITHER holds:
+
+      * its **key material** equals ``log_key_material`` (the audited log's own signing-key public
+        bytes, passed by the caller that knows which log it verifies) — the ROBUST test, algorithm-
+        agnostic and independent of the name the line claims; or
+      * its **name** equals the note's own origin line — the exact-codepoint name test.
+
+    Why BOTH, and why the name test alone is not enough (Deep-Gate re-gate 2026-08-17, F-1/F-2):
+    the Ed25519 cosignature/v1 signed message does NOT commit to the cosigner name (unlike ML-DSA-44,
+    which does), so a line CAN be relabelled under any name without the private key — a name-only rule
+    is bypassable for Ed25519, and a zero-width character in the origin line defeats the exact name
+    compare outright (closed separately by :func:`_origin_wellformed`). Keying the exclusion on the
+    LOG's public bytes uses an operand the log/attacker does not get to choose. HONEST LIMITS that
+    remain and are documented at the call sites:
+      * a log cosigning with a SEPARATE key (not its signing key) under a non-origin alias that a
+        relying party wrongly lists as an independent witness — roster provenance, a deployment
+        property no local rule can catch;
+      * the name compare is EXACT bytes (no normalisation), so BYTE-DIFFERENT FORMS OF THE SAME
+        IDENTITY are not caught by the name prong: an ASCII case variant (`LOG.example.com`, DNS is
+        case-insensitive), an FQDN trailing dot (`log.example.com.`), or a path-normalisation form
+        (`log.example.com//x`). These are the same owner, not a look-alike; the robust defences for
+        them are the key-material prong (when the log reuses its signing key) and `expected_origin`
+        (the relying-party pin). Exactness is kept deliberately — the opposite (normalising the
+        compare) would loosen `expected_origin` acceptance, whose safe direction is the reverse.
+    ``log_key_material=None`` (a direct call with no log context) applies only the name test; the
+    public surfaces always pass it (and `public_transparency` fails closed if a supplied log_vkey is
+    unusable, rather than silently dropping the key-material prong)."""
     keys_ok = set()
     witnesses = {}
+    if isinstance(threshold, bool) or not isinstance(threshold, int) or threshold < 0:    # iter5 never-raise (defensive)
+        raise BundleFormatError("witness quorum threshold must be a non-negative integer")
     # adversarial re-audit round 4: guard the SHARED SINK, not just one caller — verify_witnessed_checkpoint AND
     # public_transparency.evaluate_public_transparency both funnel witness_vkeys into this loop; a non-iterable
     # (int/bool/object) or a str (per-char iteration) crashed it raw. Fail-closed empty quorum, never a raise.
     if isinstance(witness_vkeys, (str, bytes, bytearray)) or not hasattr(witness_vkeys, "__iter__"):
         return False, {}
+    # The origin is parsed LAZILY and defensively: a malformed note must keep its existing contract
+    # (an empty roster returns without raising; a non-empty one raises in verify_cosignature below),
+    # so a parse failure here downgrades to origin=None instead of introducing a new raise path.
+    # origin=None never equals a str vkey name, and on such a note nothing verifies anyway.
+    try:
+        origin = _note_text_of(signed_note).split("\n", 1)[0]
+    except BundleFormatError:
+        origin = None
     for wv in witness_vkeys:
-        try:
-            res = verify_cosignature(signed_note, wv)
-        except UnsupportedError as exc:
-            # adversarial re-audit round 5: a BATCH quorum must not crash because ONE witness in the list is an
-            # ML-DSA (0x06) vkey the current build cannot verify (no FIPS-204). verify_cosignature keeps its
-            # documented loud raise for a SINGLE explicitly-named witness (a caller config choice, tested), but
-            # here — iterating an attacker-influenceable list — an un-verifiable witness counts as non-verifying
-            # (fail-closed False), never a raw UnsupportedError out of witness_quorum / verify_witnessed_checkpoint.
-            res = {"ok": False, "alg": "ml-dsa-44", "origin": None, "tree_size": None,
-                   "root": None, "timestamp": None,
-                   "detail": f"witness needs the [pq] extra (FIPS 204) — cannot verify, fail-closed ({exc})"}
+        res = None
+        if isinstance(wv, str):
+            name_hit = origin is not None and wv.split("+", 2)[0] == origin
+            if name_hit or log_key_material is not None:
+                # Parse to compare key material AND to learn the alg for the report entry. This keeps the
+                # documented raise contract: an unparseable vkey raises here (same typed BundleFormatError
+                # verify_cosignature would raise one line down), and a 0x01 log key is rejected AS a witness
+                # (domain separation) exactly as everywhere else.
+                _name, _kid, wv_pk, sig_type = _parse_witness_vkey(wv)
+                material_hit = log_key_material is not None and wv_pk == log_key_material
+                if name_hit or material_hit:
+                    reason = ("its name equals the checked log's own origin" if name_hit
+                              else "its key material equals the audited log's own signing key")
+                    res = {"ok": False,
+                           "alg": "ed25519-cosignature/v1" if sig_type == _COSIG_V1_SIG_TYPE else "ml-dsa-44",
+                           "origin": origin, "tree_size": None, "root": None, "timestamp": None,
+                           "origin_excluded": True,
+                           "detail": f"witness excluded — {reason}; a log never counts toward its own "
+                                     "witness quorum (origin-quorum rule, fail-closed)"}
+        if res is None:
+            try:
+                res = verify_cosignature(signed_note, wv)
+            except UnsupportedError as exc:
+                # adversarial re-audit round 5: a BATCH quorum must not crash because ONE witness in the list is an
+                # ML-DSA (0x06) vkey the current build cannot verify (no FIPS-204). verify_cosignature keeps its
+                # documented loud raise for a SINGLE explicitly-named witness (a caller config choice, tested), but
+                # here — iterating an attacker-influenceable list — an un-verifiable witness counts as non-verifying
+                # (fail-closed False), never a raw UnsupportedError out of witness_quorum / verify_witnessed_checkpoint.
+                res = {"ok": False, "alg": "ml-dsa-44", "origin": None, "tree_size": None,
+                       "root": None, "timestamp": None,
+                       "detail": f"witness needs the [pq] extra (FIPS 204) — cannot verify, fail-closed ({exc})"}
         witnesses["+".join(wv.split("+")[:2])] = res
         if res["ok"]:
             keys_ok.add(_witness_key_material(wv))
@@ -532,6 +729,9 @@ def verify_witnessed_checkpoint(signed_note: str, log_vkey: str, witness_vkeys,
     result.
     Fail-closed: an unparseable witness vkey raises; a non-verifying one counts as False; an ML-DSA witness
     this build cannot verify (no [pq] extra) counts as non-verifying, not a raise (adversarial re-audit round 5).
+    Origin-quorum rule (see :func:`witness_quorum`): a cosignature made with the LOG's own signing key,
+    or one whose name equals the origin line, never counts — this surface passes ``log_key_material`` so
+    the robust key-material test applies, not the name test alone.
 
     ``expected_origin`` (3.8.0) is the origin binding this surface was missing. A checkpoint carries
     the identity of the log that issued it, and a signature proves that SOME log signed — not WHICH
@@ -563,7 +763,10 @@ def verify_witnessed_checkpoint(signed_note: str, log_vkey: str, witness_vkeys,
     # GESTELLTE Frage, die immer fehlschlaegt, keine abwesende.
     log_ok = bool(log_res["ok"]) and (expected_origin is None
                                       or log_res["origin"] == expected_origin)
-    witnesses_ok, witnesses = witness_quorum(signed_note, witness_vkeys, threshold)
+    # DEEP-GATE F-2: the log's own signing-key public bytes are the operand the log does not choose —
+    # pass them so a cosignature made with the log key never counts as a witness, whatever name it wears.
+    witnesses_ok, witnesses = witness_quorum(signed_note, witness_vkeys, threshold,
+                                             log_key_material=_log_key_material_of(log_vkey))
     return {"ok": log_ok and witnesses_ok, "log_ok": log_ok,
             "witnesses_ok": witnesses_ok, "witnesses": witnesses,
             "origin": log_res["origin"], "expected_origin": expected_origin,

{proofbundle-3.8.0 → proofbundle-4.0.0}/src/proofbundle/cli.py

@@ -1052,8 +1052,16 @@ def _cmd_verify_proof(args: argparse.Namespace) -> int:
             # `signer_present` trennt sie: false heisst "dieser Schluessel hat diese Note nicht
             # signiert", true mit log_ok=false heisst "er hat, aber die Bytes stimmen nicht".
             out["signer_present"] = bool(res.get("signer_present"))
-            out["witnesses"] = {n: {"ok": w["ok"], "alg": w["alg"], "timestamp": w["timestamp"]}
-                                for n, w in res["witnesses"].items()}
+            # DEEP-GATE F-4: carry the REASON a witness did not count, not just ok/alg/timestamp. The
+            # CHANGELOG promises a relying party can tell "excluded by rule" from "signature invalid" —
+            # that only held at the library level; the JSON projection dropped origin_excluded and detail
+            # one layer before output, so an origin-excluded witness and a bad-signature one printed
+            # byte-identically. Both are carried now (origin_excluded only when set; detail may be None).
+            out["witnesses"] = {
+                n: {"ok": w["ok"], "alg": w["alg"], "timestamp": w["timestamp"],
+                    **({"origin_excluded": True} if w.get("origin_excluded") else {}),
+                    "detail": w.get("detail")}
+                for n, w in res["witnesses"].items()}
             print(json.dumps(out, indent=2))
         else:
             # KONTROLLZEICHEN NEUTRALISIEREN, wie es `_cmd_verify` seit dem 2026-07-09 tut
@@ -1075,6 +1083,14 @@ def _cmd_verify_proof(args: argparse.Namespace) -> int:
             n_ok = sum(1 for w in res["witnesses"].values() if w["ok"])
             print(f"[{'PASS' if res['witnesses_ok'] else 'FAIL'}] witness-quorum: "
                   f"{n_ok} valid of {len(res['witnesses'])} known (threshold {args.threshold})")
+            # DEEP-GATE re-gate F-6: the reason a witness did not count belongs on the HUMAN path too,
+            # not only in --json. Without it an origin-excluded witness and a bad-signature one printed
+            # the same "N valid of M known" line — the reader most likely to act is the one who sees
+            # nothing. One indented line per non-verifying witness that carries a detail (name+keyID is
+            # attacker-influenced, so neutralise both).
+            for wname, w in res["witnesses"].items():
+                if not w["ok"] and w.get("detail"):
+                    print(f"        - {_safe_line(str(wname))}: {_safe_line(str(w['detail']))}")
             print(f"[{'PASS' if res['inclusion_ok'] else 'FAIL'}] merkle-inclusion: "
                   f"index {res['index']} of {res['tree_size']}")
             # Der Textpfad ist der, den ein Mensch liest — und er las bisher `[FAIL] log-signature:

{proofbundle-3.8.0 → proofbundle-4.0.0}/src/proofbundle/public_transparency.py

@@ -288,9 +288,23 @@ def evaluate_public_transparency(
         elif not witness_vkeys:
             statuses["WITNESS_QUORUM"] = "FAIL"
             errors.append("witnessQuorum required but no witness vkeys supplied (fail-closed)")
+        elif log_vkey is not None and cp._log_key_material_of(log_vkey) is None:
+            # DEEP-GATE re-gate F-9: THREE states, not two. A log_vkey was supplied but is unusable
+            # (malformed / surrogate name) — that is "not measurable", NOT "no log context". Treating it
+            # as no-context (log_key_material=None) silently switches the key-material exclusion off and
+            # lets the log vote in its own quorum under an alias with errors=[]. A relying party that
+            # SUPPLIED log context and had it silently dropped is exactly the hidden fail-open; fail-closed.
+            statuses["WITNESS_QUORUM"] = "FAIL"
+            errors.append("witnessQuorum: a log_vkey was supplied but is unusable (malformed) — the "
+                          "self-witness key-material exclusion cannot be applied, fail-closed")
         else:
             try:
-                ok, _ = cp.witness_quorum(signed_note, witness_vkeys, th)
+                # DEEP-GATE F-2: when a log_vkey is known, pass its key material so the audited log's own
+                # signing key never counts toward the quorum, whatever name a cosignature line claims
+                # (origin-quorum rule). log_vkey may be absent here (optional param) — then the name test
+                # still applies, and this surface is EXPERIMENTAL/unwired anyway.
+                log_km = cp._log_key_material_of(log_vkey) if log_vkey else None
+                ok, _ = cp.witness_quorum(signed_note, witness_vkeys, th, log_key_material=log_km)
                 statuses["WITNESS_QUORUM"] = "PASS" if ok else "FAIL"
                 if not ok:
                     errors.append(f"witness quorum not met (need {th} distinct witnesses)")