[samgbafa]

Independent certificate-core checker portion

Adds certificate-core computation to the existing pinned noble checker and real CLI. The default CLI checks both committed primitive and certificate documents; an explicit path checks that document only. The existing frozen-install / bun run check entry runs all new tests, typechecking and both CLI paths.

• Branch: skgbafa/tc-2223-threshold-cert-checker
• Base branch: skgbafa/tc-2222-threshold-cert-core (feat(threshold): add authenticated certificate core. Details: TC-2222 #487)
• Exact base: 6c14b7227a0640a4f72fed496cb99938134c37ae
• Exact head: 3b5054415665446347a37a20336eb068af848a74
• One commit; all 14 changed/new files are under tinycloud-threshold/vectors/check/**.
• Author and committer were explicitly set and verified as tinycloud-bot[bot] <348376441+tinycloud-bot[bot]@users.noreply.github.com> before push.

Computations and boundaries

Executes all 18 current certificate records: canonical certificate decoding/encoding, member and commitment validation, externally anchored owner signatures, certificate and statement hashes, G2 public-share evaluations and pinned lineage; ceremony authorizations; member/owner signatures and ordered-list/recursive closed-round hashes; readiness preimages, canonical receipt encodings/hashes, binary-lexicographic hash ordering and activation; amended 259-byte signed-share Fault/NotAFault outcomes; and actual negative decoder/quorum/budget results.

All 17 synthetic-DID seed/public-key mappings are independently derived and verified with noble. They are a test signing directory, not a production DID resolver. Fixed metadata, domain tags, bounds and roles are compiled into the checker. Legitimate identities, keys and messages remain inputs.

Reference maps index recomputed input-body digests and return objects only after verification. Expected-output digests never establish authority. Unresolved, ambiguous and unanchored references are rejected. Two fixture-only omitted-anchor conventions are documented and tested:

1. The stale ceremony uses its explicit pinned_predecessor and that verified certificate's rooted external anchor. The authorization body's deliberately stale current digest does not choose the trusted predecessor.
2. The inline old-response certificate is decoded only to locate its previous digest, resolved to a verified predecessor, then verified as a successor under that predecessor's rooted external anchor. Candidate owner/network fields do not establish trust.

These are fixture cross-reference conventions, not production trust or freshness defaults. Closed-round checking preserves exact raw payloads and owner order under the trusted owner relay; it does not compute DKG phase outcomes. Receipt signatures are checked before counting/hashing/sorting, including surplus receipts. Fault attribution follows certificate/context/helper/member-signature validation before share equations.

Scope boundary: this is the certificate-core checker portion only. DKG/resharing execution and transcript outcome recomputation, and full S0.5 completion, remain pending. Producer API execution is separate from these independent checker results. No Rust, producer, fixture, shared manifest/lockfile, workflow or old checker branch changes are included.

Exercised verification

Tests were written before implementation. The initial behavior test invoked the real existing CLI on the legitimate certificate document and observed:

exit 1
FAIL schema: vectors.suite

After implementation, in isolated tool homes on the exact base/head:

bun install --frozen-lockfile && bun run check
Checked 9 installs across 10 packages (no changes)
121 pass
0 fail
501 expect() calls
Ran 121 tests across 10 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
Certificate vectors: 18/18; signing keys: 17
exit 0

The six new test files exercise independent parameters/identities, canonical boundaries, external anchoring, lineage, signed cohort selection without fallback, raw-payload retention, signature-before-quorum ordering, fault precedence, expected-digest independence, failed-verification cache behavior, unresolved/ambiguous references, record-order independence, every signing-key mapping and fixed-constant substitutions. Existing primitive test assertions are unchanged and all existing scenarios ran.

Chosen single-byte real-CLI matrix

Each mutation uses an independent in-memory clone supplied to the real CLI through /dev/stdin; the committed input is not rewritten. Every listed probe checked one changed decoded field byte and CLI exit exactly 1. Offsets are decimal and zero-based; byte values/masks are hexadecimal.

Record	Chosen field / basis	Changed actual decision
genesis-2of3	outputs.digest[31] XOR 01	Computed digest comparison
reshare-3of4	outputs.digest[31] XOR 01	Computed digest comparison
rekey-2of3	outputs.digest[31] XOR 01	Computed digest comparison
ceremony-epoch-0	outputs.digest[31] XOR 01	Computed authorization comparison
ceremony-epoch-1	outputs.digest[31] XOR 01	Computed authorization comparison
ceremony-epoch-2	outputs.digest[31] XOR 01	Computed authorization comparison
closed-round-1	outputs.transcript_hash[31] XOR 01	Computed recursive hash comparison
activate-all-2of3	inputs.receipts[0].receipt_hash[31] XOR 01	Computed receipt hash comparison
duplicate-member-did	inputs.body[143], 31 to 32	Decoder succeeds instead of declared error
trailing-certificate-byte	error UTF-8[0] XOR 01	Schema-only error-label probe
stale-ceremony-predecessor	inputs.body[0] XOR 01	Actual error becomes InvalidEncoding
signed-valid-share	outputs.signing_preimage[31] XOR 01	Computed signing hash comparison
signed-bad-share	outputs.signing_preimage[31] XOR 01	Computed signing hash comparison
genuine-old-response-after-rekey	inputs.owner_signature[0] XOR 01	NotAFault reason becomes InvalidSignature
activation-under-quorum	inputs.receipts[0].signature[0] XOR 01	InvalidReadiness before counting
activation-zero-budget	budget encoded u16be[1] XOR 01	Budget becomes 1; activation succeeds
activation-budget-overflow	inputs.candidate[31] XOR 01	UnresolvedReference before budget evaluation
activation-duplicate-member	inputs.candidate[31] XOR 01	UnresolvedReference before duplicate evaluation

The trailing-byte row additionally substitutes a valid body, proving actual decoder success disagrees with its declared error. Overflow and duplicate rows also substitute a valid budget and unique receipts, respectively, proving semantic success disagrees with the declared errors. Their one-byte reference probes are not direct repairs of the budget/duplicate signature. No arbitrary-bit-flip claim is made. The previously qualified primitive U probes are preserved.

Read-only input hashes

Input	SHA-256
cert-core.json at base 6c14b72	65d593185e97726837f6538f9dc1d5c8a9dfb8bf6c6259d1ff0fba5ce48541b2
unchanged primitives.json	654ab5445323840e78d930889d0db6aed19eafa2894f7db0c7a743a8ead12d92
approved Rust-free byte inventory	0be4d88a087b4db74c5c4a1a53597da1b3ef8719dd94f64643f08def2af8f653

Both committed JSON hashes were checked after the full run and remain unchanged. A read-only GitHub API check confirmed B #487 open/draft at the exact base above before publication.

Provenance and dependencies

This portion was written in the existing independent checker session from the immutable JSON-only B handoff, approved Rust-free byte inventory and clarified cross-reference conventions, existing independently written checker utilities, and noble-curves 2.4.0 API documentation. No Rust source/tests/diffs, dependency implementation source or other threshold implementation was opened. Private briefs/reviews are not reproduced here.

No dependency versions changed. Runtime packages remain @noble/curves 2.4.0 and @noble/hashes 2.4.0 (MIT). Development packages remain TypeScript 5.9.3 (Apache-2.0); @types/bun 1.3.1, bun-types 1.3.1, @types/node 26.6.6, undici-types 8.9.0, @types/react 19.3.0 and csstype 3.2.3 (MIT). Existing exact-version registry/license provenance and frozen integrity digests are preserved.

Clean-room statement. tinycloud-threshold is written from published papers and standards only: Shamir 1979; Feldman 1987; Pedersen 1991; Gennaro–Jarecki–Krawczyk–Rabin 1999/2007; Boneh–Franklin 2001/2003; Fujisaki–Okamoto 1999; Desmedt–Jajodia 1997; Wong–Wang–Wing 2002; Herzberg–Jarecki–Krawczyk–Yung 1995; CHURP (ePrint 2019/017); vetKeys (ePrint 2023/616); RFC 9380; RFC 9180; the IRTF pairing-friendly-curves draft; and TinyCloud's own design and plan. No source code, tests, issues or other material from TACo, nucypher, nucypher-core, ferveo, umbral or taco-web (GPL-3.0/AGPL-3.0) was opened, fetched, cloned, searched or used. Dependencies are permissively licensed and listed in the PR. Each PR keeps a provenance log of the sources consulted.

Details: TC-2223

[samgbafa]

Mechanical checker restack

• Previous reviewed head: 3b5054415665446347a37a20336eb068af848a74
• New exact head: 2465ad633ca738db7ab3b6f340fca9ba3af7caf7
• New exact B base: 5cd7867d831fb153c9dc522031caf3857b2aa9d2
• Same branch/target: skgbafa/tc-2223-threshold-cert-checker → skgbafa/tc-2222-threshold-cert-core

Replayed only the single owned checker commit. No implementation or test edits were made. Canonical bot author and committer were explicit and verified; author date and commit message were preserved. Previous review evidence and pinned checkouts were retained.

Complete byte identity

The recursive 25-file checker manifests are identical, including file modes and every blob ID. The complete subtree identity also preserves package/lock pins, compiled constants, tests, docs and corpus qualifications.

Object	Old and new identical Git object ID
Complete tinycloud-threshold/vectors/check tree	7ea6c94c35f2bad6512e9d230bf269fdd31a1d28
Primitive fixture blob	b10bd357d54647c114ff78036187401e711c12e6
Certificate fixture blob	0c3b6a74cde44492a7721e4587ca008aae5abe42

Exercised post-restack check

Exactly one frozen install/full checker entry was run at the new exact head, using fresh isolated tool homes:

bun install --frozen-lockfile && bun run check
Checked 9 installs across 10 packages (no changes)
121 pass
0 fail
501 expect() calls
Ran 121 tests across 10 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
Certificate vectors: 18/18; signing keys: 17
exit 0

Immediately before pushing, B's API snapshot still matched the recorded exact head and branch, main base 00643ae8b445e019b45a03923caf65400102825d, open state and merged=false. Publication used an explicit force-with-lease against old checker head 3b5054415665446347a37a20336eb068af848a74 and succeeded.

This is mechanical carry evidence for unchanged checker bytes on the stated parent, not a new crypto-review round, merge/fold action or full S0.5 claim. No Rust/source/parent-diff inspection, fixture edits, P3 work or new agents were involved. Edits are frozen at the new head.

Details: TC-2223

[samgbafa]

Final main-parent checker carry

• Previous reviewed carry head: 2465ad633ca738db7ab3b6f340fca9ba3af7caf7
• New exact head: b2346219b827ae587d9b331565314da22140c96c
• Exact assigned main parent: d7f88e231179ea525462a8f1582729d55735d581
• Target: main

Replayed only the single owned checker commit. All fourteen changed files remain byte-identical to the previous reviewed carry. The complete 25-entry checker manifest, including modes and blob IDs, is identical; the complete checker tree remains 7ea6c94c35f2bad6512e9d230bf269fdd31a1d28. All 1,029 tracked entries outside tinycloud-threshold/vectors/check/** match the assigned main parent exactly. Noble pins, compiled constants, documentation, tests and corpus qualifications are unchanged.

Fixture	Identical old / assigned-main / new blob ID
primitives.json	b10bd357d54647c114ff78036187401e711c12e6
cert-core.json	0c3b6a74cde44492a7721e4587ca008aae5abe42

Canonical bot author and committer were passed explicitly and verified. The original author date and full commit message were preserved. Old head/base refs, manifests, review evidence and prior receipts are retained.

Exactly one post-restack isolated invocation ran at the new head:

bun install --frozen-lockfile && bun run check
Checked 9 installs across 10 packages (no changes)
121 pass
0 fail
501 expect() calls
Ran 121 tests across 10 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
Certificate vectors: 18/18; signing keys: 17
exit 0

Retargeting to main was completed and read back while the published head was still 2465ad633ca738db7ab3b6f340fca9ba3af7caf7, before the checked-lease push against that exact old head. The push succeeded; the remote ref and PR API now both identify the new head on the assigned main parent. Normal exact-head PR checks have started; no manual workflow dispatch or trigger commit was used.

The new head is frozen for owner-seated Opus mechanical identity/composition carry and normal CI. This parent-only move does not add implementation, producer/fixture or P3 changes, repeat unchanged crypto review, merge/fold, or claim full S0.5 completion. Existing mutation and fixture-anchor qualifications remain unchanged.

Details: TC-2223