[samgbafa]

TC-2222: authenticated ceremony and certificate core

Adds the S0.2 library surface in tinycloud-threshold:

• Caller-supplied owner/network anchors, injected DID-signature verification, authorized recipient directories, signed sender cohorts, and owner-ordered closed rounds.
• Canonical certificate bodies and owner statements, decoded invariants, pinned successor transitions, public commitment evaluation, and certificate-bound candidate shares.
• Amended RequestDigest-bound response verification and fault verdicts.
• Readiness receipt preimages, unique-member quorum verification, canonical receipt hashing, and owner activation verification.
• Eighteen JSON cases for certificates, ceremony statements, closures, receipts, activation, and response verdicts; a fixture contract test replays the cases through the library APIs.

The crate remains disconnected from the node runtime. DKG/resharing execution, durable installation/retirement, and trusted log-head selection remain with their existing later-slice/integration contracts. Receipt signatures are installation claims; the library does not implement persistence or erasure.

Stack and commits

• Actual-main cutover base: 00643ae8b445e019b45a03923caf65400102825d; PR target is main.
• Owned tests commit: 53145ce3fc872bd8aa2fcc9296b7f382227faee6; owned implementation/vector commit: 90ef643cc13e607cf19e1f1803a74cc5c78d9a83.
• Fresh owner wiring: 999ec5dfbf7ba31cfd69448beb00175d91256a5c; separate approved SPEC/README reapplication and mechanically checked intermediate: 6b409d647b85bf32e42c4f1d9ba2d8f8342ce435. Older shared commits were excluded from replay.
• Final test-only commit/head: 5cd7867d831fb153c9dc522031caf3857b2aa9d2, adding one owner-signature test (26 insertions, no deletions) atop that intermediate.
• Author and committer of all five lane commits use the canonical tinycloud-bot[bot] identity.

test-ruling: TC-2222

Exercised verification

Construction evidence

• On the original N1-based construction branch, tests-only modules were wired first. cargo test --locked -p tinycloud-threshold produced the authorized unresolved-symbol compiler RED before the fresh implementation; this was a compiler failure, not a runtime behavioral failure. An earlier prepared draft was deleted before that run.
• Fresh implementation passed 61 tests, lint/format checks and pinned cargo-deny 0.20.2. Its advisories, bans, licenses and sources results are retained for the byte-identical dependency files after the owned-only restack; policy was not needlessly repeated.

Reviewed frozen-head evidence, retained at its exact pin

At head 6c14b7227a0640a4f72fed496cb99938134c37ae on base 31d2b2c3866483b119501e4a5041a0d0a104737c:

• cargo test --locked -p tinycloud-threshold: 61 passed, 0 failed, 0 ignored.
• cargo clippy --locked -p tinycloud-threshold --all-targets -- -D warnings: passed.
• cargo fmt -p tinycloud-threshold -- --check: passed.
• The named unit-test-harness smoke passed: anchored genesis, bound-share issuance/combination/derivation/unwrap, 3-of-4 reshare with four bound candidates and all-holder activation, subsequent re-key, response attribution, and quorum rejection.
• Separately compiled and executed a throwaway standalone consumer linked to the normal library build, outside cfg(test). It replayed all 18 committed JSON cases through the public certificate, DID-signature, ceremony/closure, fault and activation APIs. Output ended CONSUMER PASS cases=18 cfg_test=false; wrong-anchor/signature and closure-order mutations were also rejected. No private candidate constructor or product scaffold was added; temporary source/executable were removed.
• Rejection/mutation tests cover decoded certificate fields and commitments, lineage/counters, ceremony and closure substitutions, signed cohorts, response context/signature/equation distinctions, and activation receipts/budgets.

Actual-main cutover and test-only head

The byte-identical cutover and fresh shared composition were checked at intermediate 6b409d647b85bf32e42c4f1d9ba2d8f8342ce435 on actual main 00643ae8b445e019b45a03923caf65400102825d. All five owned files, shared crate files and both docs matched the approved frozen head. Main's other lock records were preserved; only the existing test-verifier edge was added.

At final head 5cd7867d831fb153c9dc522031caf3857b2aa9d2:

• cargo test --locked -p tinycloud-threshold: 62 passed, 0 failed, 0 ignored.
• Scoped clippy with -D warnings and cargo fmt -p tinycloud-threshold -- --check: passed.
• The single new test uses real signing fixtures and checks that valid non-owner signatures and byte-mutated owner signatures return CertError::InvalidSignature. A bounded disposable mutation experiment compiled successfully and produced the intended runtime assertion failure, validating this test's sensitivity; the copy was deleted.
• Product/protocol code, existing assertions, shared files and the 18-case JSON fixture were unchanged by the test-only commit. Earlier standalone-consumer and policy results remain labeled to their original execution pins.

Dependencies and provenance

Runtime dependencies are unchanged: blst (=0.3.16), sha2, zeroize, subtle, rand_core, and thiserror. The added dev dependency is exactly ed25519-dalek 2.2.0, already resolved in the parent lockfile. Existing test dependencies remain proptest, rand_chacha, serde, serde_json, and hex. The pinned dependency-policy check passed.

Consulted TinyCloud's protocol specification and its defined interfaces, plus the existing S0.1 types, codecs, curve boundary and test-only dealer. The new certificate tests reuse that dealer; no production dealer or alternate cryptographic wrapper was added.

The documentation owner additionally consulted the ed25519-dalek 2.2.0 crate metadata/README, without opening dependency implementation or source links.

Clean-room statement. tinycloud-threshold is written from published papers and standards only: Shamir 1979; Feldman 1987; Pedersen 1991; Gennaro–Jarecki–Krawczyk–Rabin 1999/2007; Boneh–Franklin 2001/2003; Fujisaki–Okamoto 1999; Desmedt–Jajodia 1997; Wong–Wang–Wing 2002; Herzberg–Jarecki–Krawczyk–Yung 1995; CHURP (ePrint 2019/017); vetKeys (ePrint 2023/616); RFC 9380; RFC 9180; the IRTF pairing-friendly-curves draft; and TinyCloud's own design and plan. No source code, tests, issues or other material from TACo, nucypher, nucypher-core, ferveo, umbral or taco-web (GPL-3.0/AGPL-3.0) was opened, fetched, cloned, searched or used. Dependencies are permissively licensed and listed in the PR. Each PR keeps a provenance log of the sources consulted.

Details: TC-2222