[samgbafa]

Change

Adds the unwired tinycloud-threshold workspace member for TC-2219 / TC-2092: canonical encodings, typed identities, FullIdent wrapping, context-bound encrypted member shares, individual verification, interpolation and reader unmasking. No workspace crate depends on it; default-members is unchanged; publishing and release-plz releases are disabled.

SPEC.md records §§3.0–3.12 and marks §§3.1–3.6 frozen. Approved §3.6 amendment: encoded shares include the request digest, also explicit in the response signing preimage, so identity/tpk transplants return ContextMismatch before algebra. The named S6 test is request_transplants_fail_before_algebra.

Local verification (Rust 1.97.1)

• cargo test --locked -p tinycloud-threshold: 44 passed, 0 failed; 0 doctests.
• cargo test -p tinycloud-threshold checkpoint_2of3 -- --nocapture: one test printed and passed outcomes 1–9.
• PROPTEST_CASES=1024 cargo test --locked -p tinycloud-threshold --release: 44 passed, 0 failed; 0 doctests.
• cargo clippy -p tinycloud-threshold --all-targets -- -D warnings: passed.
• cargo fmt --all -- --check: passed.
• cargo deny --manifest-path tinycloud-threshold/Cargo.toml --locked --config tinycloud-threshold/deny.toml check licenses bans advisories sources: all four checks passed using 0.20.2. The CLI places --config before check.
• Standalone public-API executable: wrapped the fixed data-key vector, checked canonical ciphertext/request/three-share decoding and rejected malformed U. The executable was removed afterward.
• Workspace metadata/manifest checks confirmed all four unwired conditions.

Named coverage includes checkpoint_2of3, request_transplants_fail_before_algebra, both_share_equations_and_deduplication, all_threshold_subsets_and_zero_aggregate_masks, fullident_integrity_degenerate_randomness_and_redacted_secrets, decoded_structures_enforce_roles_lengths_and_network, random/structured reject-or-canonical decoder properties, and identity roundtrip/injectivity properties.

RFC tests: rfc9380_appendix_j_g1_sswu_ro, rfc9380_appendix_j_g2_sswu_ro, rfc9380_appendix_k1_expand_xmd_sha256. Vector files: primitives.json, rfc9380-g1.json, rfc9380-g2.json, rfc9380-k1.json under tinycloud-threshold/vectors/v1/. The primitive fixture regenerated byte-for-byte in both complete suites.

CI and separate-session checker

The threshold job defines the full 1024-case release suite, selected dependency policy and unconditional bun install --frozen-lockfile && bun run check step in vectors/check/. Existing workspace build/test/clippy/fmt jobs also cover the crate.

Draft handoff: acceptance item 10 (the separate-session checker) and its CI result are pending that session's contribution. The checker step is not conditionally skipped. No checker result or green full-CI result is claimed here.

Dependencies and licence

The crate uses the workspace EGPL v1.5 through license-file = "../LICENSE.md" and publish = false. The crate-scoped cargo-deny policy includes development/build dependencies and restricts the EGPL clarification to this package with licence-file hash 0x2a86e8e4.

Scope	Dependency	Resolved version	Licence
production	blst	0.3.16	Apache-2.0
production	sha2	0.10.9	MIT OR Apache-2.0
production	zeroize	1.8.2	Apache-2.0 OR MIT
production	subtle	2.6.1	BSD-3-Clause
production	rand_core	0.6.4	MIT OR Apache-2.0
production	thiserror	2.0.18	MIT OR Apache-2.0
development	proptest	1.9.0	MIT OR Apache-2.0
development	rand_chacha	0.3.1	MIT OR Apache-2.0
development	serde	1.0.228	MIT OR Apache-2.0
development	serde_json	1.0.149	MIT OR Apache-2.0
development	hex	0.4.3	MIT OR Apache-2.0

Clean-room statement

Clean-room statement. tinycloud-threshold is written from published papers and standards only: Shamir 1979; Feldman 1987; Pedersen 1991; Gennaro–Jarecki–Krawczyk–Rabin 1999/2007; Boneh–Franklin 2001/2003; Fujisaki–Okamoto 1999; Desmedt–Jajodia 1997; Wong–Wang–Wing 2002; Herzberg–Jarecki–Krawczyk–Yung 1995; CHURP (ePrint 2019/017); vetKeys (ePrint 2023/616); RFC 9380; RFC 9180; the IRTF pairing-friendly-curves draft; and TinyCloud's own design and plan. No source code, tests, issues or other material from TACo, nucypher, nucypher-core, ferveo, umbral or taco-web (GPL-3.0/AGPL-3.0) was opened, fetched, cloned, searched or used. Dependencies are permissively licensed and listed in the PR. Each PR keeps a provenance log of the sources consulted.

PROVENANCE

• TinyCloud approved plan-r2, SHA-256 f701d2be11bc525395ecfde7cc8c9c09bdde51ba56b88b476900090d605b4d14: protocol equations, domains, field roles, frozen encodings, context boundaries and acceptance scenarios. SPEC.md carries §3, with neutral wording and the explicit request-digest amendment.
• Supplied plan-r2 delta notes: total unavailable-ready-holder arithmetic and the trusted owner-relay scope, reflected in SPEC.md.
• RFC 9380, §§5, 5.3.1, 5.3.3 and 8.8; Appendices J.9.1, J.10.1 and K.1: XMD, scalar-field H3, hash-to-curve suites and the published vector data. RFC pre-cofactor Q0 coordinates supply subgroup-decoder cases.
• IRTF pairing-friendly-curves draft 11: BLS12-381 fields, tower and compressed-point conventions.
• blst 0.3.16 API documentation and its versioned README: FFI signatures, documented struct layouts, scalar multiplication and inversion entry points, decompression/subgroup APIs and reduced pairings. No dependency implementation source was consulted.
• Direct Python standard-library hashlib and integer arithmetic, following RFC 9380: independent scalar reduction/H2/H3/H4/tagged-hash known answers and off-curve fixture arithmetic; no other curve/scheme implementation.
• Existing TinyCloud workspace manifest, release config, CI workflow, licence and instructions: package placement, release exclusion and CI conventions. cargo-deny 0.20.2 CLI help, licence policy docs, command docs, release metadata and licence inventory: explicitly selected policy, dependency coverage and checksummed tool installation.
• The request-digest amendment was explicitly approved in the builder conversation. request_transplants_fail_before_algebra covers its S6 behavior.
• The independent TypeScript checker is assigned to a separate builder session consuming SPEC.md and vector JSON, without reading Rust code. This builder did not implement it and claims no checker result.

Details: TC-2219

Signing helper API update

At d91c16c8e9e4b43006f1a8942952f935a7005c51, EncryptedKeyShare::signing_preimage returns Result<Vec<u8>, Error> and requires the supplied request digest to equal the digest carried by the share. Valid signing-preimage bytes and all committed vectors are unchanged. Changes are limited to src/derive.rs, src/checkpoint.rs and the necessary valid-call migration in src/vectors.rs.

The focused changed-record-nonce regression passed. The affected crate suite passed 45 tests; crate-scoped clippy with -D warnings and formatting passed. A standalone public-API executable matched all three committed valid preimages and exercised the request-match result.

test-ruling: TC-2219

This ruling covers only the mechanical updates to existing test callers for the new Result return. No assertion changed.