Changelog

Short commit hashes cited in this repository refer to the pre-publication development history, which is not public. This public history starts at the import of 2026-10-01.

unreleased — 2026-10-01, the rehearsal, the site, and the first two products

Incident rehearsal T14 ran (spend/soak/README incident #5, INCIDENT.md; timeline in the operator's drill directory): detect → wallet-rpc down 1 min 41 s → last sweep to the vault 15 min 26 s; the vault spendable 35 min after detect; a NEW keeper live on this tree 36 min after detect; its first payment 70 min after detect (the swept-back funds sat in one output, locked 20 min per spend). All 592 lines of the burnt keeper's log verify. Fees 0.0158 XMR, 17 % of the wallet: sweep_all at priority 4 and 3 refused 182 small outputs, priority 2 took them; 0.00003638 XMR of dust is unsweepable. The freeze failed as written: systemctl --user mask --runtime is overridden by unit files in ~/.config/systemd/user, so Restart=always revived the burnt keeper for 23 s (no request reached it; the log stayed byte-identical). Fixed by spend/soak/freeze.sh/unfreeze.sh (c38b9e3): a Restart=no drop-in, daemon-reload, kill -9, then an assertion that the unit stays down and spend.lock survives — proven on a scratch unit against the old way. Also from the drill (1b574ac): the vault's wallet-rpc needs --no-initial-sync before refresh {start_height} can be sent; gen-keys.mjs no longer rewrites the tracked policy template and now mints roots that sigelo-offline recover accepts (the old soak's random S.hex was not recoverable); steps 5–6 are a concrete per-identity recover procedure. Open spec gap: the keeper's own DID cannot be recovered — its recovery key derives from spend.key, which the thief holds (ROADMAP §5.6). The live soak now runs this tree (REVISION c2c9cdc at 13:56Z) and rode through a second host network outage the same afternoon: it paid on the first tick after the network returned.
The site (site/, 0a4381f, 4bf622b, 3c2d364): sigelo.io as a static, agent-first site generated from the tree — 17 pages each with a .md twin and rel=alternate, llms.txt, llms-full.txt, adopt.md, robots.txt naming the AI crawlers, sitemap.xml, .well-known/security.txt, index.json with the spec and vector sha256s, JSON-LD on every page, raw and content-addressed copies of the docs, the mock world served; integrations/mcp/server.json. Its own test: 255 checks, and site/test/TASK-site.md — a Haiku agent given only the served site and the release files installed from the tarballs, checked SHA256SUMS, made a tier-2 identity, got attested by the served world and produced a bundle the release verifier accepts: 6/6 in 97 s (docs-test/RESULTS.md). Not deployed: hosting and the maintainer's name wait on D1.
Recovery ceremony kit (kit/, ad970a5; product page 3c2d364): the offline high-security tier as a product an operator runs alone — ceremony/run.sh refuses to run online, runs ceremony --human (words to the terminal only, proven on a pty), writes backup.age and a secret-free record; the printed procedure (ceremony, drill, runbook bound to the operator's paths by bind.mjs, rendered by print.sh); drill/schedule.mjs and grade.mjs (the T14 timeline scores 100/100); CONTACT.md. The vendor never receives, holds or sees any key, seed, backup or share — boxed on every page (MiCA: software and facilitation, no custody). Package sigelo-recovery-kit 0.1.0, the fifth release artefact. 25 + 32 checks (the drill and runbook pages re-synced to the rehearsal's fixes and the licence reissue step, 9f75a7d).
Keeper installer and tiers (17e7787, eb9f428): sigelo-spend init sets up one keeper on the operator's own host and wallet-rpc (optionally writing the wallet-rpc unit, loopback, --rpc-login), doctor checks the install, receipts export and licence show|install. Free tier: one keeper, one agent, that agent's whole policy. Paid verbs — /delegate, /fund, /approve, a pay above approval_above, receipts export, a second init on the host — refuse 403 licence_required without a licence; /revoke and /delegates are never gated; an expired licence stops only the paid verbs. The licence is a sigelo attestation issued by the vendor DID to the keeper's DID (claims {tier, seats}, exp), verified offline by the repo's own verifier; no network call anywhere; no wire change. No hosted mode exists or will. spend: 659 → 725 passed with the live wallet; pack-test 20 checks over five packages; SHA256SUMS identical across two builds.
A keeper's own DID is recoverable (164b8c4, cc0a83c; closes the gap the rehearsal found). sigelo-spend init writes the keeper genesis to a public identity.json committing to the Owner's root recovery key (k(S, "sigelo/v1/recovery/ed25519"), the key every agent already uses; from the ceremony's keeper-<j>.json via --keeper-package, or --recovery-commitment), and refuses a genesis whose recovery would derive from spend.key or be null. After a compromise: sigelo-offline recover --genesis identity.json <root> --new-keeper … offline, then sigelo-spend init --adopt recovered.json on the new host serves the same chain[0] DID that receipts, approvals and the licence name; the thief's later voluntary rotation loses (SPEC §7). Proven end to end in the spend suite with ts and Go agreeing. No wire change: every genesis already carries a recovery commitment; which key it names is key management. Keepers keyed before this (the live soak's) stay legacy and unrecoverable until their next rekey. ts 620 → 628, spend 725 → 745.
The soak is a paying customer of its own keeper (5b4a488): gen-keys.mjs mints a soak-local TEST VENDOR and issues keeper/licence.json (tier pro, 4 seats, 400 days) to the keeper's DID; setup.sh sets SIGELO_VENDOR_DID in a unit drop-in; check.mjs reports UNHEALTHY under 30 days to expiry. Proven in a scratch keeper: /delegate 200 with the licence, 403 licence_required without. The soak now exercises the paid tier end to end; a real deployment gets its licence from the vendor at D1.
The installed MCP plugin (integrations/mcp, as installed on the maintainer's host on 09-24) was exercised live from a Claude Code session: whoami → bundle → verify, and the release sigelo-verify at c2c9cdc accepts the plugin-made bundle identically.
Round 3b (docs-test/RESULTS.md). The Haiku lifecycle run repeated on the docs of 9516622, after a795275 gave QUICKSTART the exact ed25519-test bind() call, a Timestamps paragraph and the recovery-beats-iat worked example: 10/10 (7/10 two days earlier on the same task). The R3 bar (≥ 9/10 at Haiku tier) is met with Claude models; non-Claude families still wait on API keys.
wallet_slow (spend/, 98ea994). Soak tick 5: a transfer build took 152 s on the slow daemon link (decoy selection; the same delegate's next build took 9 s), the keeper's 60 s wait ran out and it answered the generic wallet; nothing was relayed — the build is do_not_relay, relay_tx is called only with metadata the keeper received and only after the fsynced intent line, and a repeat is answered from the log — so fail-closed held, but the code was wrong and a tick was wasted. Builds (transfer, sweep_all) now wait 180 s, every other call 60 s, and a build that outlives its wait answers TRY LATER wallet_slow ("the wallet is still working on that payment; nothing was sent"). Tests: the late build is never relayed, the repeat pays once, a third run is ALREADY PAID, a relay_tx timeout stays UNCERTAIN. spend 745 → 756.
Contact surface (a52163e, 17477fb). /contact on the site (one maintainer, contact@sigelo.io, SimpleX on public relays, security reports to /security; no form by design), the SimpleX address as one constant feeding the page, security.txt, index.json and the JSON-LD ContactPoint, omitted everywhere until it is set so no placeholder ships; both mailboxes exist and are read. site 272 checks.
Public since 2026-10-01. First push: https://github.com/csigelo/sigelo, main bca5b16 (the export of 13e3b12). release/publish.sh now has an update mode (8a024b3): against the pushed clone it builds, gates and tests the export in a temp tree and commits one sync: commit on top of main; fresh mode is refused on a clone with a remote. The first GitHub run failed in three places, all fixed from a clone of the public repository (1bcb01f, 0fbd592, 1cde665, 268111d): two crosscheck result files had no final newline, which the portability line-ending check read as "no line ending" on every OS (the check now fails only on CRLF or mixed endings, in index or checkout); pack-test.sh honoured a runner's XDG_CONFIG_HOME and so looked for the identity outside its test home; the actions were pinned to Node 20 versions (now v7, by sha). The DEVICE_STRINGS identity gate fails loudly when the secret is missing in this repository and reports hits as file and count only; it is its own job so it never hides the other results. The spend step of the ts job failed on the runner and passes here under the same node, npm and shell; it now annotates its FAIL lines so the next run names the check. macOS and Windows are still unproven at runtime.
sigelo.io is live (site/deploy/, deployed 2026-10-01 from the export): one Let's Encrypt certificate for sigelo.io, www, sigelo.net and its www (the .net names 301 to the apex), nginx with the security headers, no client IPs in logs, HSTS at five minutes for the first week; the server is key-only SSH with root login off, fail2ban, a firewall and unattended upgrades.
Deploy tooling (site/deploy/, ca39b0e). server-setup.sh once as root (nginx + certbot, the sigelo user, TLS 1.2+, HSTS starting at 5 minutes, CSP default-src 'self', www → apex, no client IPs in logs, 7-day rotation), deploy.sh user@host (builds, runs the 272 checks, uploads with rsync or tar | ssh, swaps atomically, keeps dist.prev, --rollback, --dry-run), check.mjs against the live origin (45 checks incl. headers, content types, sha256s and the build commit), and a sudo-limited helper so the deploy key never installs an arbitrary nginx config. Deploy from the public export, never from the private tree: index.json records the build commit. Tested locally end to end through a fake ssh; certbot and nginx -t need the server.
Drill cadence. The kit's schedule.mjs installed the quarterly reminder on the test host; the next drill is 2027-01-01.
D1, most of it decided (8cde486, f85a42a, 724a903): the domain is sigelo.io, the account csigelo (https://github.com/csigelo/sigelo, Go module github.com/csigelo/sigelo/go at export, MCP registry name io.github.csigelo/sigelo), the e-mail contact@sigelo.io (reports stay security@sigelo.io); the pseudonym is the handle. The site linked to blob/master/… while the export creates main — every repository link would have 404'd after the first push; fixed. Still open: the age recipient and SimpleX address for disclosure, the vendor DID ceremony for licences, prices and hours on the kit and keeper pages, hosting and DNS.

spend 659 → 745 passed with the live wallet. Code lines: spend/service.ts 1 037, spend/cli.ts 126, spend/init.ts 494, spend/licence.ts 84, ts/src/ceremony.ts 169, ts/src/offline.ts 167 (CLAUDE.md).

unreleased — 2026-09-29 (evening), round 3 on today's docs, the one-seed ceremony, Carrot, and a stranger's clone

Round 3 of the comprehension harness (docs-test/RESULTS.md), docs frozen at 9dadab0 (docs-test/snapshot/9dadab0, lifecycle digest ff3639074728bd09…, verifier 469da8a3c59fe898…). Lifecycle from the docs alone: Sonnet 10/10, Haiku 7/10 (its binding was cross-signed but dated now + 3600, so §9 step 6 discarded it; and its thief's rotation carried an earlier iat than the recovery, the inverse of the task — it spaced every iat like a story) — the ≥ 9/10 Haiku bar (ROADMAP R3) is still not met. Both trace to facts the docs stated only as permissions in SPEC: a795275 gives QUICKSTART the exact ed25519-test bind({… addr_secret, iat: now}) call, a Timestamps paragraph (a future-dated binding is discarded, never pass a later now), and "recovery beats iat" worked at T and T+3600; ts/README's API notes say the same. To be re-measured at the next round. A verifier from SPEC and vectors alone, in Python (1 033 lines, PyNaCl + pycryptodome, Edwards arithmetic by hand): 139/139 on grade-verifier.mjs and 139/139 on sigelo-verify --conformance --impl, first iteration, no spec finding. Perl was the second candidate language and is not possible on the test host (no Ed25519 library, no compiler). Every run was a Claude model; the non-Claude runs still wait on API keys. Transcripts were audited for reads outside the allowed files: none.
M4, the human's seed (278e87c, 29a0402). ceremony --human writes the 25 words to /dev/tty only, after backup.age exists, and refuses without a terminal; restore --words <file|-> takes them from a file or stdin, never the command line, and reproduces --backup byte for byte; ceremony --import of an existing seed is refused unless --i-know-this-seed-was-cold, with the liability printed. The backup field stays mnemonic (sigelo-root/2 since feb7e96). "Vault only, never a hot wallet" is on every ceremony screen.
M6, FCMP++/Carrot (085bf06, ROADMAP §2). The 25-word legacy root survives: Carrot keeps the a = H_s(b) hierarchy, subaddresses and address format for sending and receiving, the reference wallet still restores only legacy seeds, and no wallet-rpc method sigelo calls changed. Re-check when seraphis-migration#306 (the new-wallet seed format) closes, when carrot_impl merges, or when a mainnet height is set. Follow-ups applied (ba825f3, b5eeadd, 4daef77, 9241e04, cad0357): the wallet-rpc canary pinned version 1.30 exactly and so already failed on the current release 1.31 — it accepts 1.30–1.33 now, with the ceiling to move after an oracle run; the unused get_tx_key: true is gone; Polyseed is in monero core since 2026-09-20 (PR #10765) and is still not used (it cannot carry S); the promise reads "any Monero wallet that restores a 25-word (legacy) seed"; get_tx_proof is flagged not yet functional on the FCMP++ stressnet.
A stranger's clone of the public export (49c585a). Everything ran green from the single-commit clone in a private network namespace: every suite, build.sh twice with identical SHA256SUMS, pack-test.sh, the sim (all three digests), crosscheck/run.sh with --self-test, QUICKSTART tiers 1 and 2, --impl 139/139. Fixed from its findings (5e96d29, 77a7be4, 78878b6, da03f18): every suite count in the READMEs and ROADMAP re-measured (conformance 242, go test 498, --impl 139, --break 136/139, pack-test 16 + its own build, ts 620, spend 659); the soak policy template held two real stagenet subaddresses and ts/test/monero-vectors.json held oracle signatures from the same wallet — placeholders now, filled by gen-keys.mjs policy, and the vectors re-signed from a scratch wallet; QUICKSTART's walkthrough files and world.lock are ignored, crosscheck runs write to an ignored results/latest/; device and desktop specifics in the docs replaced by "the test host".

ts 595 → 620, spend 652 → 659, go 498. Code lines: ts/src/ceremony.ts 150, ts/src/offline.ts 150, spend/service.ts 974 (CLAUDE.md).

unreleased — 2026-09-29, the readiness bar: six gaps closed in one day

wire: an envelope has exactly its defined keys (bcee912, SPEC §3.1; vectors attestation_good_and_envelope_extra_keys, binding_envelope_extra_key, binding_envelope_sig_id_only_unproven, fatal_rotation_envelope_extra_key; attestation_envelope_extra_key_int flips from accepted to discarded). The 30-day freeze count runs from this change.

ROADMAP §1 was re-measured against the tree (d07f077) and every gap that needed no Owner decision was closed the same day, each by its own agent, each proven before its commit. One wire change (the envelope rule above); the spend keeper's formats are unchanged; the live soak still runs 6df3b67.

Tokens re-read per request (spend/, 37190c5). The simulation's live-policy scenario showed token new printing "the old token no longer works" while the old token kept paying and the new one got 401 until a restart, so a leaked token outlived the command meant to kill it. The keeper now checks policy.json's mtime on every request and, when it changed, validates the whole file but takes only the token hashes of roots it already serves: the old token is refused and the new one pays with no restart. Everything else in the policy still needs a restart, including a new root — MONERO.md §6 now ends that procedure with one, and the CLI says exactly this. A malformed file, or one that gives two roots the same hash, keeps the last good tokens and logs a warning.
Envelopes have exactly their defined keys (SPEC §3.1, bcee912, wire). Both verifiers accepted unknown keys in an envelope — outside the signature, so unauthenticated — while unknown body fields were refused; a third implementation could have read §3.1 either way. Now an extra key discards an attestation or binding and is fatal in a rotation envelope, in ts and go alike; the schemas refuse it and the moadim adapter stores only body and sig. The 1f916 bare-served attestation the sim planted is now discarded by rule, not by a hash mismatch.
Two behaviours named (5cde1ac). A duplicated attestation counts twice (SPEC §9.1: the verifier reports what it was given, invariant 8, as it does for rotations); a retired world key keeps minting valid attestations under its old DID until they expire (SPEC §5, THREAT-MODEL §3.2).
Keeper daemon fallback (spend/, e9b4970). SIGELO_DAEMONS is an ordered list of daemon addresses. After three wallet-rpc builds in a row with "no connection to daemon", or 20 minutes of a stuck height while asked to pay, the keeper calls set_daemon (untrusted) on the next one — never on one failure, never more than once a minute, one warning line and no spend.log line. With fewer than two addresses nothing changes. 23 tests on the fake wallet.
Soak alerts (246fd66) and the clock at boot (4ec79b2). check.mjs --notify writes soak-alerts.log and raises a critical desktop notification when UNHEALTHY; sigelo-soak-check.timer runs it hourly. The agent unit runs systemd-time-wait-sync (10 s) as an ExecCondition, so a tick is skipped, not run, until NTP has set the clock — After=time-sync.target orders nothing in a --user unit (the keeper started at "2026-01-11" on 09-26). The keeper unit sets four stagenet nodes as SIGELO_DAEMONS. Nothing was installed or enabled on the soak host.
Third-party cross-check (crosscheck/, 0a17aa3, T12). JCS against the RFC 8785 reference (6/8 testdata byte-equal, the two float files refused as §3 requires; 20k documents, 100k integers, 100k doubles equal; 1 800 forbidden inputs rejected), base58/addresses/25-word seeds against monero-python (10k/20k, 5k wallets, 2.5k subaddresses, 20k address checks, 4k/8k seeds, ts and go), Ed25519 against libsodium, RFC 8032, Wycheproof 151/151 and speccheck 12/12: 0 divergences. run.sh --self-test corrupts sigelo's answers and every section catches it. monero-python itself departs from Monero's C++ three times (2^64 base58 block, word triples ≥ 2^32, no curve check); sigelo sides with the C++. Not covered: SigV2 (no oracle here).
Simulation gaps (sim/, ecb7f17, 4d14292, ddff500). Dishonest worlds: 400 bundles over 36 SPEC-cited cases (future and backdated iat, small-order issuer keys, reused nonces, unchallenged and rotated-away DIDs, forged issuers, replays, a collusion ring) — ts and go agree on all 400, 13/13 mutants killed, one (future iat accepted) invisible to the old swarm. Delegates of delegates to depth 4 with a revoked middle delegate (7/7 planted bugs caught). policy.json edited under a running keeper: 78/78 steps; the policy is read at start only, as documented, and two docs promised otherwise — token new's "the old token no longer works" and MONERO.md §6's new root without a restart (fix below, G7). The 1f916 adapter runs as a world; serving its genesis bare again makes every bundle fatal in both verifiers. npm run sim 5 min; npm run plants 10 min.
Installable packages (20fd24e, 7cdf4ea, T4 code side). No file: dependency in a packed manifest (release/prepack.mjs), bins from dist/, LICENSE in each tarball, SIGELO_PUBLISH=1 guard. release/build.sh builds from a clean clone of HEAD: 4 tarballs, static sigelo-verify for five targets, a Go source archive, SHA256SUMS identical across two builds. release/pack-test.sh installs them where no clone is: 17/17. Publishing waits on D1.
Conformance for foreign implementations (c4cef7d, 4e1a5aa, T7). sigelo-verify --conformance --impl '<command>' runs a candidate over all 135 bundle cases with grade-verifier.mjs's protocol and exits 1 on any FAIL: Go as its own candidate 135/135, ts 135/135, a broken wrapper 133/135. A weekly CI canary runs spend/canary.ts against the pinned and the latest monero-wallet-rpc (unrun on GitHub yet).
Docs measured (d07f077, 81a6500, 327e266, 7cefd5d). ROADMAP §1/§6 re-stated with a commit per claim; the 1f916 proposal says upstream's repository answers 404 and 1eedadd came from public forks; THREAT-MODEL §3.7a and INCIDENT §1 cover a wrong clock and an offline host.

ts 591 → 595, go 494 → 498, spend 617 → 652 passed with the live wallet. Code lines: ts/src/sigelo.ts 364, go/sigelo.go 383, spend/service.ts 975 (CLAUDE.md).

unreleased — 2026-09-29, soak incident #4: 32 h offline, and the clock

The test host lost its network for 32 h because its network manager stopped auto-connecting after a failed handshake and nothing could re-authorise it unattended. The keeper failed closed — nothing was sent, every line verifies — but the tooling around it did not see the outage, and the investigation found a latent wrong-clock risk. Keeper wire formats (receipts, spend-approvals, log lines) are unchanged; no error code was renamed.

Clock guard (spend/). Every route that signs (/pay, /fund, /delegate, /revoke, /approve, /bind) refuses 503 clock_behind — a TRY LATER, nothing signed, logged or sent — when the keeper's clock is before its build floor (2026-09-29) or more than 300 s behind the newest ts it signed in spend.log. The test host's clock boots at 2026-01 (its build epoch) until NTP; without a network the keeper would have signed lines with January ts that fall out of every cap window once the clock is right: spends that never counted, in a log that cannot be corrected.
wallet_offline (spend/). A wallet-rpc "no connection to daemon" is its own TRY LATER code and line ("the wallet has no connection to the Monero network"), not the generic wallet: for 32 h the agent could not tell the host's network from a wallet fault. relay_tx failures stay UNCERTAIN whatever their text.
Wallet store (spend/). After every relay_tx, once the answer is sent and still in the lane, the keeper calls wallet-rpc store; a failure is a warning and never changes the verdict. The soak wallet file was 12 days stale (every stop a crash), so each boot rescanned for 18 minutes. close() waits for the lane.
Soak agent. Snapshot timeout 30 s → 90 s (it collided with wallet-rpc's 30 s refresh-retry). A tick whose wallet height did not advance, or where the keeper said wallet_offline, is an outage tick: an expected-success TRY LATER there is outage, not MISMATCH (outage_ticks), and a carol rent given up after 3 h of nothing but outage TRY LATERs is abandoned_offline. The 6 mismatches of this outage were the keeper being right.
Soak check. UNHEALTHY with no payment in 2 h, a wallet height stuck across the last two snapshots, or a log clock in the future or stepping back — it said HEALTHY for all 32 h. --evidence checks a burnt directory without asking the live host.
Soak README. Incident #4 and the wrong-clock note; the T14 rehearsal fixed where the step-0 run found it wrong (the wallet-rpc is a systemd unit, gen-keys before setup, the vault's creation command and seed warning, sweep back to the allowance address after 10 confirmations, step 7 with --evidence).

spend: 592 → 617 passed with the live wallet (559 → 584 + 2 skipped without it).

unreleased — 2026-09-24, hostile-JSON differential (ts vs go)

wire: D1 nesting depth 512 (425d2bb), S1 created format (bc7165a), S2 canonical curve points (731483b), S3 commitment format (63cceed), S4 nonce format (c5faf69), S5 noncharacters (001ecfa); vectors named in each bullet below. Recorded here 2026-09-29 to satisfy VERSIONING.md §1; the 30-day freeze count (ROADMAP R6) runs from the last of these.

A differential of 1 805 hostile documents through both verifiers found three verdict divergences, four message-level ones, two slow paths and five gaps against SPEC. Closed here, each in both implementations with the same reason text, a SPEC MUST and vectors:

D1 Nesting depth is bounded at 512 levels (SPEC §3). Go's recursive parser died of a fatal, uncatchable stack overflow near 750 000 levels (a 1.6 MB document), where ts, iterative, answered; deeper than 512 is now a parse error in both, nesting deeper than 512 at offset N, and both canonicalizers refuse it. Vectors raw_depth_512_in_claims, raw_fatal_depth_513_in_claims.
D2 ts picked the latest recovery iat with Math.max(...list), one call argument per valid recovery rotation; past ~125 000 of them at one node V8 threw RangeError (a crash naming no check) where Go answered VALID or recovery tie. A loop now, and no argument spread over data is left in ts/, spend/, adapters/, integrations/ or sim/ (a ts test scans the built verifier for one). SPEC §9: exhausting a resource is not a verdict.
D3 Two shipped TypeScript readers, sim/verify-one.mjs (the ts half of the sim's Go differential) and integrations/skills-cli/sigelo/verify.mjs, read files as 'utf8' strings: invalid bytes became U+FFFD, so a bad genesis nonce verified as a different, VALID identity where sigelo-verify rejected the document. Both read bytes through parseBytes now and say parse: … as sigelo-verify does; so do sigelo-spend pay's request file, the keeper's torn-tail repair and the ceremony restore. The swarm simulation presents BYTES (new tamper and fuzz kind invalid-utf8), so it can see this class at all.
P1 Base58 decoding is quadratic and ran before the 34/64-byte checks: a 300 000-character signature (per item) or genesis key (fatal) took 79 s in Go and over three minutes in ts. SPEC §2 now bounds a multibase key at 64 characters and a signature at 100, checked after the (linear) alphabet scan and before decoding, same reason text in both. Vectors fatal_genesis_key_too_long, attestation_sig_too_long.
S1 created was checked only for being a string: 23:59:60Z, +05:30, .123Z, a space for T, 2026-13-45T25:61:61Z and "yesterday" all verified. SPEC §4 now fixes the form (exactly YYYY-MM-DDTHH:MM:SSZ, a real date, no leap second) as a MUST, fatal in every genesis slot; the JSON Schema drops its leap second. Attestations and bindings carry no timestamp string (their iat/exp are integers), so there is no per-item case. Vectors genesis_created_leap_day, fatal_genesis_created_leap_second, fatal_genesis_created_feb_29_common_year, fatal_issuer_created_offset, fatal_next_genesis_created_fraction.
S2 Key slots were checked for the multicodec prefix and 34 bytes only: an all-zero, identity or y ≥ p key made a VALID identity or issuer no signature could ever verify under. SPEC §2: key, recovery_key and an ed25519-test addr MUST be a canonical point not of small order (Go: edwards25519 SetBytes + canonical re-encoding + cofactor; ts: noble Point.fromBytes(…, false) + isSmallOrder), fatal in a genesis or rotation, per item in a binding. Issuer keys are genesis keys, so they are fatal (invariant 7), not per item. Vectors fatal_genesis_key_all_zero, fatal_issuer_key_identity, fatal_rotation_recovery_key_y_ge_p, binding_ed25519_test_addr_all_zero_unproven.
S3 The recovery commitment was checked for its sha256: prefix only, so sha256:, sha256:xyz and UPPERCASE hex verified — the last silently disabling recovery, since no key's commitment is ever spelled that way. SPEC §4: exactly sha256: + 64 lowercase hex, fatal in every genesis slot. Vectors fatal_genesis_recovery_uppercase_hex, fatal_genesis_recovery_prefix_only.
S4 Nonces were any string ("\u0000", emoji, U+2028, /, z + hex). SPEC §2: a genesis, binding or invoice nonce is z + 1 to 63 base58btc digits, fatal in a genesis, per item in a binding; the §5.2 challenge nonce stays opaque. Three spend/ test invoices used nonces with I, O or l and were respelled. Vectors fatal_genesis_nonce_z_hex, binding_nonce_not_multibase, binding_nonce_65_characters, binding_nonce_64_characters.
S5 SPEC §3.1 cites RFC 8785 and so I-JSON, which forbids noncharacters as well as lone surrogates, but both parsers accepted U+FFFF as a key and a value. Now a parse error in both, raw or escaped (an escaped pair counts), at the string's opening quote, noncharacter U+FFFF in string at offset N; both canonicalizers refuse one built in memory, so no conforming library signs what no conforming parser reads. The schema's string refuses them too. Vectors raw_fatal_noncharacter_in_claims_value, raw_fatal_noncharacter_astral_in_claims_key.
M1 Parse-error offsets differed by one between the two parsers on bad \u escape, expected ":", expected "," or "}" and expected "," or "]" (ts incremented past the character before failing; Go peeked), though go/jcs.go claimed both said the same. Both now report AT the offending character, the convention the Go fail comment spells out; a nine-message table runs in both suites.

unreleased — 2026-09-24, audit before the public export

wire: A1 two identical rotation entries are a fork (7c285ea, vector fatal_duplicate_rotation_is_fork).

Self-audit of the whole tree (AUDIT.md), three findings closed with tests and vectors:

A2 A document holding invalid UTF-8 was rejected whole by the Go verifier but read lossily by every TypeScript caller, which discarded one item and accepted the rest. New parseBytes() decodes fatally and is used at every file, body and stdin edge (CLI, mock world, keeper, MCP server); SPEC §3 states the rule. Same bytes, same verdict.
A1 Two byte-identical copies of one voluntary rotation are two candidates and REJECT the chain as a fork, in both verifiers. SPEC §7.3 now says so; vector fatal_duplicate_rotation_is_fork.
A3 The 1f916 adapter bound a DID after checking only three genesis fields; it now checks the full §3.1 shape and names the bad field.
release/publish.sh: the public repository is a fresh single-commit export (pseudonym, UTC, identity-string gate, every suite run inside the export), not a rewritten history.
A4 The export's identity-string gate silently passed on busybox: GNU-only grep flags made grep exit 2 and the script read the swallowed error as "no hits". It is now git grep over HEAD with exit 0/1/other handled explicitly; the CI check excludes release/publish.sh as it excludes its own file; ROADMAP §5.1 no longer spells the strings the gate looks for.
spend/soak: gen-keys.mjs passes nonces as bytes (the hex strings it used to pass were stored verbatim, a genesis the SPEC §2 nonce rule now rejects); a compat <dir> mode, run by setup.sh before any file is copied, refuses to redeploy over a live soak this code's verifier would not accept; an existing keys/approver.json is never overwritten. Soak incident #3 (near miss).
A5 The gate's own files still spelled three "generic" patterns and excluded themselves from the search, so the first export published exactly the strings it guarded. No tracked file holds a pattern now: all come from the DEVICE_STRINGS secret / private pattern file, an empty list refuses to export, nothing is excluded. ROADMAP §5.1 no longer describes the maintainer's setup.
PORTABILITY.md: what is proven, documented and unrun across operating systems.

unreleased (still wire `sigelo/0`) — 2026-09-17

Spec gaps found on first independent review, all closed with vectors.

Bundles carry issuers (bare genesis documents) so attestations from unknown worlds verify offline. Previously §9 asked for a genesis the bundle had no slot for.
Chain walk rejects cycles (next already in chain) and self-rotations. A naive walk looped forever on a rotation back to an earlier DID.
New vector rotation_hostile_carried: a fully valid voluntary rotation defeated only by recovery precedence. The old hostile vector also failed the commitment rule, so a verifier without precedence still passed. chain_precedence_only isolates it.
JCS done properly (py/jcs.py): UTF-16 key order, ES6 escape set, duplicate keys rejected, non-integer literals rejected at parse. Vector attestation_unicode carries the exact canonical string. The old json.dumps(sort_keys=True) mis-sorted non-BMP keys.
§9 takes now as input and returns a specified result shape (§9.1). Vector bundle fixes the expected result for a full bundle, including per-item rejections.
Binding proof status is three-valued: proven, unproven, unsupported. Bad proof is discarded, not downgraded. admission restricted to the six defined values.
THREAT-MODEL §4 citation corrected against the Reuters story (2026-09-04): OpenAI agents, DseWiki, 15,000+ edits; the "propagates to later agents" clause was not in the source and was replaced with what the researchers actually observed.
§5.2 fixes the proof-of-control handshake (typ: "challenge") so worlds interoperate on the one step they all need. Vector challenge.
Round 2, after a from-spec-only implementation test: §3.1 normative field table with a no-unknown-keys rule; §7.4 separates "not a candidate" from "REJECT the chain" with a per-failure table; §7.3 rejects two recoveries tied on iat; §2 states the signature and DID encodings that were only inferable from examples; the signing prefix is given as bytes; §9.1 key order is informative. The four "not a candidate" negatives ship complete envelopes and state the resulting chain. New: bundle_minimal, a second issuer in bundle, rotation_bad_sig, unknown_field_*.
QUICKSTART.md and examples/world.mjs, after three fresh-agent adoption runs.
Monero: MONERO.md design; §6.2 rewritten with the real SigV2 construction and the view-mode binding; the "view key for a single subaddress" claim was wrong (Monero has one view key per wallet) and is replaced by proofs and per-relationship wallets. method: "monero" bindings verify in ts/ and py/ against vectors from Monero core, cross-checked with monero-wallet-rpc 0.18.5.0.
§6.3 invoices: a new signed object naming where to pay this time, under the identity key, never in a bundle. { v, typ, did, method, addr, iat, exp, nonce } plus optional amount (a string of atomic units) and memo. A structure() slot in both implementations, not a sixth constructor. Vector invoice.
Root-seed derivation (ts/src/keys.ts): one 32-byte S, HKDF paths for identity, recovery and each Monero wallet (MONERO.md §2), carried by a 24-word BIP-39 mnemonic that is transport for S only and is not a Monero seed. sigelo-offline new|derive (ts/src/offline.ts) is the air-gapped box's whole job and withholds the treasury spend key and the recovery secret unless --reveal-all. Interop is tested live: a derived wallet is imported into a stock monero-wallet-rpc by private spend key and the stock wallet reproduces our address, view key, spend key and subaddresses.
py/monero.py: the Python half of §6.2 — Keccak-256, edwards25519 group ops, Monero base58, addresses, subaddresses and SigV2 — so py/reference.py verifies method: "monero" bindings and the two implementations agree on them.
sigelo-spend (spend/): the MONERO.md §4 policy service. Loopback HTTP, bearer token, allowlist by literal address or by DID-with-attestation (bundle verified offline, address must be a proven binding or a §6.3 invoice), per-transaction cap, per-period budget, rate limit, buckets pinned to Monero accounts, unlock_time forced to 0, and an append-only log of receipts signed by the service's own sigelo identity. In CI; the live-wallet section SKIPs there.
adapters/moadim: Monero commands wallet-set, bind, receive, invoice and verify-invoice, in their own file so the identity core stays at 77 lines. The agent holds (a, B) and can never spend; bind computes the view-mode sig_addr locally, with no wallet and no daemon.
sigelo-spend spent real coins end to end on stagenet (2026-09-23): 5e8 atomic units from account 0 to the wallet's own subaddress (0,1), fee 30500000, txid 2582d050b5ca46ae4901317d85ce60511c962aaebce16af60b2aa526367fe63d; over-cap request refused 403 per_tx_max, receipt verifies under the service key, /budget accounted it. spend/test.ts §3 now pays from the funded account (largest unlocked_balance) instead of the fixture's empty account 1, still --dry-run only.
Vectors: 18 positive groups, 27 negative cases (vectors holds 19 entries — the extra one, expected_chain, is a shared expectation, not a vector).
§3.1 field types, enforced by structure() in both implementations: iat/exp are integers in [0, 2^53−1] with exp > iat; every other field is a string except recovery, claims, amount and the bundle's own fields. The two verifiers disagreed on identically signed bindings: iat: "5" or null verified proven in TS (comparison coercion) and raised TypeError in Python, killing the bundle; an addr array of characters verified proven in Python only. Envelope junk (a null binding entry crashed TS; non-dict entries crashed Python; a non-string rotation sig was fatal in TS but ignored in Python) now has one outcome.
JCS: a lone surrogate is rejected by both canonicalizers (RFC 8785 requires I-JSON; TS used to sign it as U+FFFD, so two bodies shared a signing input). The key __proto__ is rejected by both strict parsers and both canonicalizers: ts/src/jcs.ts assigned it, which swapped the parsed object's prototype instead of adding a key. The TS parser now defines properties.
§6.2: a Monero address whose prefix is a non-minimal varint (92 00 for 18) is refused by both decodeAddress implementations, as wallet2's read_varint does (EVARINT_REPRESENT, src/common/varint.h). Monero base58 decoding accepts only strings.
Vectors: 13 new negative cases (40 total), among them parity, 48 malformed bundles that both verifiers must take to the same result or the same rejection. At b348b5d, 20 of the 60 §3.1 and parity checks diverged between the implementations and 17 crashed one of them.
sigelo-spend (MONERO.md §4), after independent review: two-phase relay — transfer with do_not_relay/get_tx_metadata, caps checked, every line signed, an fsynced intent line, then relay_tx, then relayed or relay_failed (still debited: the daemon may have taken it). Money could previously move with no log line: a to.did that could not be signed threw after the wallet paid (5 requests → 5 transfers, 0 lines), as did a slow or non-JSON wallet reply. Caps count amount + fee (1-atomic payments at a 3e7 fee drained ~8.6e10/day against a 1000 cap). to takes only {addr, did, bundle, invoice} with a string did, own properties only; purpose ≤ 200 characters. Dry runs sign nothing — no receipt, dry_run: true, rate-limited, no budget. Invoices go through structure(), must name a subaddress, are paid exactly their amount, and once (nonce logged). status is inside the signed entry; lines without one are read as legacy relayed.
moadim sidecar: bind, wallet-set, rotate, add-issuer and add-attestation take the lock receive takes; a bind interleaved with a receive wrote the old counter back and the same subaddress was handed out twice. verifyInvoice refuses a non-subaddress addr.
§9 step 2 / invariant 7: a non-integer number, lone surrogate or "__proto__" key inside ONE attestation or binding (body or envelope) now discards that item and counts it; before, both verifiers canonicalized the whole bundle first and rejected it outright. The bundle-level check covers only what defines the identity (shape, genesis, rotations, issuers), where the same fault stays fatal. parity +6: binding_iat_float flips to discarded; good+float binding, float sig_addr, good+__proto__ and good+lone-surrogate attestations (the latter as raw text), and fatal float in a rotation body and in an issuer genesis.
Vector generator ported to TypeScript (ts/src/gen_vectors.ts, npm run gen), step 1 of replacing Python with Go as the second verifier. It reproduces test-vectors.json byte-for-byte; CI now regenerates with both generators and diffs each against the committed file. What a further port must match: insertion key order ({...x, k: v} keeps k in place), monero_spend_seed after negative, JSON.stringify(…, null, 2) with no trailing newline, and lone-surrogate raw text as compact ASCII-only JSON with lowercase \uXXXX. The generator refuses integer-like keys, which JavaScript would silently reorder.
ts/src/test.ts: a slow monero-wallet-rpc (fetch TimeoutError) mid-interop is a SKIP, not an uncaught exception.
go/: step 2 of that move, the §9 verifier in Go (Verify, Structure, JCS parser and canonicalizer, §6.2 Monero, and a static sigelo-verify CLI). It has one dependency, filippo.io/edwards25519; Keccak-256 is ported rather than taken from x/crypto. go test runs every check py/reference.py runs, with identical PASS names (185 lines, diffed), plus JCS, json/v2, Ed25519 edge-case and 1f916-fixture tests. CI job go runs it next to the Python job. A differential against ts/dist gave byte-identical outcomes: §9.1 JSON or the exact rejection message, over 71 vector bundles × {strict text, parsed value} and 3,000 seeded random mutations. Two edge cases are deliberate. Ed25519 is verified with @noble's zip215: false strictness, not crypto/ed25519's: canonical A/R, no small-order A, cofactored. Parse-error offsets count UTF-16 units, as ts/ does. encoding/json/v2 is not used: it fails the whole document on a lone surrogate, where §9 step 2 discards only the item carrying it.
Step 3, the move is done: the Python implementation is removed. go/ is the reference verifier (217 checks, ALL PASS), ts/src/gen_vectors.ts is the only vector generator and CI still diffs its output against test-vectors.json byte-for-byte. The 1f916 adapter's cross-check (was adapters/1f916/check.py) is Test1f916 in go/sigelo_test.go, over the same sample-bundle.json, now also asserting the claim names and integer counts check.py asserted. The moadim adapter's test re-verifies its bundle with go/cmd/sigelo-verify instead of Python (SKIPs without go; CI installs Go in that job and fails if it skipped). CI has two jobs, ts and go; nothing needs a Python interpreter.
Go-port review, three findings, fixed in ts/ and go/ with vectors. (1) Monero points are decoded as Monero decodes them: ge_frombytes_vartime (src/crypto/crypto-ops.c) refuses y >= p and x = 0 with the sign bit set, and get_account_address_from_str runs check_key on both address keys. Both decoders had been permissive (noble zip215: true, edwards25519 SetBytes), and in spend mode the view key is only hashed, so an address Monero refuses could carry a proven binding. Now strict everywhere a point is decoded (address keys, check_signature's key, subaddress derivation); §6.2 says so. Vectors binding_monero_view_key_y_ge_p, binding_monero_spend_key_x0_signbit: genuine signatures, discarded. (2) Whole-envelope canonicalization is pinned: parity binding_envelope_float_unsupported_method (sig_addr: 1.5 on a method nothing verifies) and attestation_envelope_extra_key_float are discarded; attestation_envelope_extra_key_int pins that an extra envelope key is otherwise ignored. A body-only canonicalizer fails exactly those two in both test suites. (3) The strict parser no longer rejects a whole text over one number: a non-integer or out-of-range literal parses to a value (ts RawNumber, go Number) that canonicalization refuses, so it is per-item like the same value arriving as an object; duplicate keys and __proto__ stay fatal to the text (§3). raw parity vectors raw_binding_good_and_float, raw_attestation_good_and_int_out_of_range (per-item), raw_fatal_rotation_iat_float, raw_fatal_attestation_duplicate_key (fatal). ts 284 checks, go 236; differential 159/160 over vector bundles (the one difference is the harness's JSON.parse path on the duplicate-key text) and 6000/6000 over the 3,000 mutations.
MONERO.md §8 G4, keeper roots (ts/src/keys.ts): keeperRoot(S, j) = k(S, "sigelo/v1/keeper/<j>") and agentIdentitySeed(K, i, n) = k(K, "sigelo/v1/identity/<i>/ed25519/<n>"), same HKDF and path conventions as the existing branches; indices are safe non-negative integers, printed decimal. deriveRoot takes keepers = 1 and returns keepers: [K_0 …]; every other output is unchanged (test-vectors.json regenerates identically, the stock-wallet interop still passes). sigelo-offline derive hands K_0 to the operator (the agents' keeper, §2 table), so a restore by derive recovers it. Fixed vectors over the test root S1 for K_0, K_1, agent (0,0) and (1,0), cross-checked against an independent HKDF; ts 291 checks.
sigelo-spend, MONERO.md §8 G1 — per-agent entries. The policy's buckets become agents: each entry holds its own token_hash, account, caps and allow. A token maps to its agent by comparing it against every agent's hash with no early exit; unknown and revoked tokens get the same answer. The account always comes from the entry; a request's bucket, still accepted, must name the token's own agent. New destination {label} resolves only against the agent's own allowlist; new rule {issuer, ctx?} admits any DID holding that attestation, under the same binding-or-invoice rule. /budget, /log and /health answer for the caller's agent only (/health gives its account balance, not the wallet's). Validation moved to policy.ts parsePolicy and is now strict at every level (unknown fields; shared accounts or token hashes; literals not payable on net; a non-null approval_above, refused until G6 enforces it). Pre-G1 files load as one agent named after their one bucket; a file with several buckets under one token is refused. Log lines now carry request.agent; older request.bucket lines still replay. sigelo-spend token new <policy> <agent>.
sigelo-spend, G2 — ref idempotency (§4.1 step 4, §4.2). Every spend has a ref: the one sent, or sha256(account ‖ JCS({to, amount, purpose})) with to taken without its bundle. ref and the request fingerprint are logged per agent. Within dedupe_seconds (default 600) a repeat gets the first outcome back from the log and builds nothing: the same receipt for relayed (already_paid: true), the same UNCERTAIN for relay_failed or for an intent whose outcome a crash never wrote, and 202 approval_needed for pending (a status no G1/G2 code writes; it debits nothing). An explicit ref reused for a different request is 409. Five existing checks sent identical bodies to test budgets, rate and invoice replay; they now vary purpose so each is still a separate payment. spend/ checks: 148 → 227.
go/keys.go: MONERO.md §2 key derivation in Go, mirroring ts/src/keys.ts so a Go keeper derives the same keys without ts: K (HKDF-SHA256, empty salt, path as info, stdlib crypto/hkdf), IdentitySeed, KeeperRoot, AgentIdentitySeed, RecoverySeed, RecoveryPublicKey, RecoveryCommitment, WalletFromRoot (sc_reduce32 branch) and DeriveIdentity (a reproducible genesis from explicit created/nonce). Indices are uint64 capped at 2^53−1 with ts's error strings. go/keys_test.go pins ts's fixed keeper/agent vectors and the identity key, DID, recovery commitment and stagenet/mainnet wallet keys and addresses that ts derives from S1. No new dependency. Go checks: 236 → 262.
MONERO.md §8 G7 — the root ceremony (§4.5). sigelo-offline ceremony --net <net> --recipient <age1…> --out <dir> [--keepers N] [--treasury-keeper j] generates S, derives with deriveRoot, and writes backup.age (age to the Owner over the §4.5 JSON: v, mnemonic, created, keepers, public), fingerprint.txt (JCS(public), public = treasury and allowance addresses and the recovery commitment) and a 0600 keeper-<j>.json per keeper (K_j, net, keeper identity public key, recovery commitment; keeper 0 adds the allowance wallet and the root identity seed; --treasury-keeper adds the treasury wallet). S, the mnemonic and the recovery secret appear nowhere but inside backup.age. age is a shelled-out age/rage (no npm dependency), injectable in src/ceremony.ts; missing binary or a bad recipient exits 2 and writes nothing. sigelo-offline restore --backup --identity --net [--reveal-all] decrypts, re-derives, refuses on a fingerprint mismatch, and prints the fingerprint and each K_j. derive output renamed to the keeper vocabulary: operator → agents_keeper (inner field names unchanged), air_gapped → owner_backup; new keepers list and --keepers N; agent.treasury unchanged for sigelo-agent wallet-set. Keeper packages are plaintext 0600 on the ceremony host, not encrypted per keeper host as §4.5 step 5 has it. ts checks: 291 → 313 (four of them with the real age binary, SKIP without it).
MONERO.md §8 G3 — the agent surface (§4.2), in spend/. Routes, all behind the agent's token and answering for its own account only: GET /balance (get_balance on the account + what the policy still allows), POST /receive {purpose?} (create_address on the account, labelled with the purpose, rate-limited in memory by rate_per_minute), GET /history?n= (the agent's log, one entry per payment, + get_transfers in/pool pinned to the account), POST /bind {body} (the keeper's view-mode sign at (0,0) over a binding body that passes structure(body, 'binding'), names the agent's registered did — new optional, unique per-agent policy field — and the wallet's base address, with a window ≤ 30 days; the signature is verified as view-mode before it is returned). Every error now carries code (the refusing check) and cap refusals facts (affordable returns them). New spend/wallet.ts, bin sigelo-wallet: balance, receive [note], pay <to> <amount> [purpose] [--ref R] [--atomic], history [n], --json; XMR↔atomic by string arithmetic (≤ 12 decimals, no sign/exponent/blank/leading zero); one line per verb; the message table and exit codes 0–4 in spend/README.md, with the weak-agent prompt snippet matched to the CLI. Departures from §4.2: receive mints a subaddress but no invoice (no amount, no SIGELO_IDENTITY); the command is sigelo-wallet, not wallet; the snippet says "within 10 minutes". spend/ checks: 227 → 324 (5 of them against the live stagenet wallet, read-only and a view-mode sign; nothing relayed, no create_address).
MONERO.md §8 G5 — delegation (§4.3), in spend/. New spend/tree.ts (pure): the tree is replayed from signed delegate/revoke lines in spend.log on top of policy.json's agents (the roots; policy.json stays the Owner's file); a delegate's caps are refused above its delegator's at creation and clamped to the minimum along its ancestors at every spend, period_seconds is the root's, allow keeps only rules every ancestor still covers; revoke cascades to the subtree and is idempotent; account indices and names are never reused; a delegate whose root left policy.json is orphaned (dead). Count rule: max_delegates bounds the whole subtree — each live child reserves 1 + its own, a child's is at most its parent's − 1. Routes: POST /delegate {name, fund, caps?, allow?} (create_account, skipping held indices; identity agentIdentitySeed(K, i, 0) with the new optional policy field recovery_commitment; a token returned once, its hash in the signed line; fund > 0 is a transfer to the delegate's (i, 0) through the ordinary two-phase /pay path, counted against the delegator), POST /fund {name, amount, ref?}, POST /revoke {name} (signed line, subtree's tokens dead at once, then sweep_all {address, account_index, subaddr_indices_all: true, priority, unlock_time: 0, do_not_relay: true, get_tx_metadata: true} per account to the revoker's (r, 0), dust (amount ≤ fee) and locked balances skipped, intent/relayed lines per sweep tx), GET /delegates. spend.key is now documented as the keeper root K (the ceremony's keeper_root_hex): the keeper signs with identitySeed(K, 0) as before, delegates derive from the same K; tree lines must verify under that key or the service does not start. sigelo-wallet delegate <name> <fund> [--per-tx X] [--per-day Y] [--allow label=addr ...] [--max-delegates N], fund, revoke, delegates — not in the weak-agent snippet (§9 decision 9); delegate prints the URL and token once under "Give this to the delegate, it is shown once:". Departures from §4.3: no approval_above in the ask (G6); the keeper does not cross-sign the delegate's binding at creation (the delegate calls POST /bind, which now works for it); the credentials are the HTTP answer / CLI output, not a 0600 file; the Owner revokes through a root's token (no keeper-host admin command); /fund only by the direct delegator. spend/ checks: 324 → 413 (88 new), all passing with the stagenet wallet reachable. create_account and sweep_all have not been run against a real wallet (G8).
MONERO.md §8 G6 — approvals (§4.1 step 8, "The spend-approval"), in spend/. New spend/approval.ts (pure): the closed spend-approval body {v, typ, keeper, net, agent, ref, to, amount, purpose, nonce, iat, exp}, signed by an approver over "sigelo\n" ‖ JCS(body), and its checks in §4.1's order — fields and typ, this keeper's DID and net, iat ≤ now < exp and exp − iat ≤ max_approval_ttl, the approver's bundle verified offline with its current DID in approvers, the signature under that DID's current key, the body equal field for field to the keeper-signed pending request with that nonce, not the agent (by DID, by the approver's chain, or by the agent's key under another DID) and not the keeper, the nonce neither approved nor spent. A /pay above approval_above (amount alone, after caps and rate, before any wallet call) gets 202 approval_needed with the body and writes a signed pending line (no debit, one rate tick); POST /approve {body, sig, bundle} (no token) writes a signed approved line; the agent's re-run of the same pay goes through every check again and the two-phase relay, and its intent line names the nonce in request.approval, which spends it — a further run is the ordinary ALREADY PAID. Pending and approved lines answer until the request's exp, not dedupe_seconds; an expired request frees the ref for a fresh one with a new nonce; an approved line counts only if it verifies under the keeper key. Policy: approval_above is an atomic-unit string or null (the G1 "refused at load" placeholder is gone); set, it needs the agent's did and a new optional genesis field that hashes to it, and a non-empty approvers; approvers must be DIDs, unique, and not an agent's own; max_approval_ttl defaults to 3600. Delegates: approval_above in delegate lines may be a string, /delegate takes caps.approval_above (refused above the delegator's), and the effective threshold is the lowest along the ancestors. The keeper's DID is now stable across restarts (genesis nonce from its key, created pinned, as SPEC §3.1 allows) because approvals name it. sigelo-spend approve-request <policy> <ref> prints the body to sign; the approver signs with its own tooling and posts to /approve. Departures from §4.1: nonce added to the body (single use checkable from the log, and an old signature cannot answer a later request for the same ref); the approver must sign the keeper's body exactly (it cannot choose its own iat/exp); root agents with a threshold must carry genesis. spend/ checks: 413 → 487, all passing with the stagenet wallet reachable. Not run against a real wallet (G8).
SPEC §6.2 (Owner decision 2026-09-23): a method: "monero" binding's addr may be a subaddress as well as a standard address; integrated stays refused (verified live: a base-address signature verifies for the integrated spelling, and 0.18.5 still makes them) and so does SigV1. A subaddress is checked against its own (D, C), the keys wallet2::sign's subaddress branch signs with (b + m spend, a·(b + m) view), and is proven in either mode; for a subaddress, view mode does not imply a view-only signer. ts and go verifySigeloMoneroSigAddr refuse only kind == integrated now. Vectors: the negative binding_monero_subaddress_addr is retargeted into positives binding_monero_subaddress_spend and binding_monero_subaddress_view (both proven), plus the negative binding_monero_subaddress_base_sig (subaddress addr, signature by the base keys: discarded). ts/test/monero-vectors.json gains wallet_rpc_oracle: a live stagenet monero-wallet-rpc's stateless verify on those vectors (stagenet spellings) and its own sign at (0,0)/(0,1) in both modes — all nine agree with ours. MONERO.md §3/§4.2: /bind still signs the keeper's base address (no spend/ change); an account's (i, 0) is now bindable by spec. The moadim wallet-set error no longer says the spec forbids subaddresses. ts checks: 313 → 329; Go checks: 262 → 278.
spend/ POST /bind signs at the caller's OWN account address (i, 0) (SPEC §6.2 accepts subaddress bindings): addr must be get_address {account_index: i} — the keeper's base address is refused for any agent above account 0 — and the keeper calls sign with account_index: i, address_index: 0, spend mode for i > 0 (a subaddress's view signature needs the spend key anyway, secret a·(b + m), so view mode would claim less without protecting anything), view mode at (0,0) for account 0 as before. The result is checked for that mode by that address before it leaves; the answer adds account and mode. A delegate binds the DID from its delegate line. Also: /delegate's fund object no longer lets the spend body's status string overwrite the HTTP status (a funding that waited for approval read status: "approval_needed", never 202). The mock wallet now signs as wallet2 does at any (major, minor). Tests: mock bind at (1,0) spend + (0,0) view, cross-account and base-address refusals, wrong-mode 502s, a delegate's bind proven; live: a spend-mode sign at an existing account (i, 0) (SKIP until the wallet has one). spend/ 487 → 499 checks (496 + 1 SKIP while the wallet has no account above 0).
G8 (MONERO.md §8): stagenet end to end through spend/dist and sigelo-wallet — delegate, approval-gated funding, pay / ALREADY PAID, an above-threshold pay waiting for and using one approval, a delegate's (1, 0) binding, revoke with a real sweep_all. Script outside the suite; txids in MONERO.md §8.
spend/ review 2 (MONERO.md §4.1, §4.2, §4.3). The lane could freeze: /pay, /approve, /delegate, /fund and /revoke queued first and read their body only at the front of the queue, and the body read settled only on end/error — a client that went away while queued (a half-sent body, or sigelo-wallet's own timeout behind a slow wallet build) never fired either, and every later spend waited forever. Now the body is read whole before the request joins the lane (1 MB → 413, 10 s → 408, a gone client settles it too), and a queued request whose client has left is dropped at its turn with no wallet call and no log line. Names: a root the Owner removed kept its log lines but freed its name, so a delegate given that name read its /log, /history and /budget and answered its refs; every name spend.log names is now taken, and an agent in policy.json whose name the log shows on another account refuses the start. One keeper per directory: spend.lock (O_EXCL, pid) next to spend.log; a second start is refused while the pid is alive, a dead pid's lock is taken over, a reused pid is removed by hand (README). Stale waits: a pending or approved line is judged by the current policy — threshold off or raised → it pays (an approval on file is still spent); approval by an approver since removed → a fresh 202 with a new nonce instead of a 403 until exp. CLI: nothing from an invoice file or history is printed raw (addresses and names in their own shapes, free text as printable ASCII, else a JSON string with C1/bidi escaped too; --json as well), so a crafted invoice cannot print a second line; a pay/fund timeout is UNCERTAIN … Run `sigelo-wallet history` before paying again. (exit 4), not TRY LATER; locked change still in the pool says "a payment is still confirming … about 20 minutes"; the locked-sweep line is one sentence. Also: a delegate's own approval_above is refused while the policy lists no approvers; self-approval is refused for any key in the approver's verified chain, not only its current one (the requester's own rotated key stays unknowable to the keeper — documented). SIGELO_WALLET_TIMEOUT_MS and ServeOptions.bodyTimeoutMs for tests. Three checks that planted an unsigned pending line under a policy without approval_above now expect the payment (G2) or use an agent that really needs approval (G3). spend/ checks: 499 → 529, all passing with the stagenet wallet reachable.
The root is a Monero 25-word seed (Owner decision; MONERO.md §2, §4.5). S is carried as Monero's Electrum-style English mnemonic (src/mnemonics/electrum-words.cpp at monero d02c7c57: 4 LE bytes → 3 of 1626 words, 25th word = CRC-32 of the 3-letter prefixes mod 24), replacing the 24-word BIP-39 transport (ts/src/bip39-english.ts removed; wordlist now ts/src/monero-words.ts / go/monero_words.go, SHA-256 pinned). Its own wallet, the vault (b = sc_reduce32(S), a = H_s(b)), restores from the 25 words in any stock Monero wallet; it is the Owner's cold wallet and never loaded by a keeper — no keeper package carries a vault key (tested). Every derivation is unchanged: treasury, allowance, keeper roots, identities and recovery stay HKDF over S, so test-vectors.json and every existing key vector are byte-identical. S must be canonical (0 < S < l): past l a wallet shows back sc_reduce32(S)'s words, which sigelo would read as another root — so newRoot draws from [1, l) and words, hex and the ceremony refuse anything else. ts: newRoot() returns 25 words; rootFromMnemonic, mnemonicFromRoot, encodeMoneroWords/decodeMoneroWords, vaultFromRoot; deriveRoot gains vault. Go: RootFromMnemonic, MnemonicFromRoot, EncodeMoneroWords/DecodeMoneroWords, VaultFromRoot. sigelo-offline new [--net] prints 25 words and the vault address; derive <25 words|hex>; derive/restore print the vault address, its keys only under --reveal-all (owner_backup.vault); the ceremony backup is sigelo-root/2 (mnemonic = 25 words; fingerprint unchanged) and restore refuses sigelo-root/1 by name. Three fixed vectors (V1 hashed, V2 = 2^252−1, V3 = l−1) and a 64-root sweep digest pinned in both implementations; oracle: monero-wallet-rpc 0.18.5 restore_deterministic_wallet from our words returns our address, b, a and our words (stagenet in the suite; mainnet once by hand), create_wallet's words round-trip through ours, non-canonical words restore to a wallet showing other words, and wallet2 refuses the past-2³² triple and a wrong checksum word as we do. ts checks: 329 → 355; Go checks: 278 → 295.
Keeper API made consistent (found writing spend/openapi.yaml; code fixed, README and openapi now agree with it). POST /delegate's funding outcome is fund: {http, …body}: the HTTP status no longer overwrites the body's status, so a funding above approval_above now reads {http: 202, status: "approval_needed", code: "approval", …} (sigelo-wallet delegate now reads fund.http; it says NOT FUNDED — WAITING FOR APPROVAL, exit 3). GET /health checks the wallet's reply — a missing height or a balance that is not atomic units is 502 code: wallet, never "undefined". A missing, unknown or revoked token is 401 code: token on every route, /pay included (was 403 there). Every error body has a code: /health's 502 (wallet) and the catch-all 500 (internal) gained one. README: the route shapes (/history {agent, account, entries}, /bind {addr, account, mode, sig_addr}, /delegate caps.approval_above, /budget, /health), the two 202 shapes (fresh: error; replay: repeat, pending) and /approve's 400/408/413/500 codes. spend checks: 561 → 564.
Dependencies pinned per VERSIONING.md §6, with no version change: exact versions in ts/, spend/ and adapters/moadim/ (@noble/ed25519 3.2.0, @noble/hashes 2.4.0, typescript 5.9.3, @types/node 24.13.5), lockfiles regenerated (npm install --package-lock-only: only the declared ranges and stale bin metadata changed, every resolved version and integrity is the same); go/go.mod gains toolchain go1.27.1; every GitHub Action in conformance.yml is pinned to a full commit SHA with its tag in a comment (checkout and setup-node v4 → v4.4.0, setup-go v5 → v5.6.0, upload-artifact v4 → v4.6.2: what those major tags pointed at on 2026-09-23).
Docs closed for the three gaps round 3's docs-only Haiku run exposed (docs-test/RESULTS.md, 5/10), no code or wire change. QUICKSTART: the mock world is a program run from the repo root, with its two commands, what each prints and its state files (./world.local.json, ./challenge.local.json); every sigelo-agent line has a # library: equivalent (the docs-only condition has no CLI); step 0 also writes recovery.pub and shows it as one bare line. SPEC §2's nonce row and ts/README: z + base58btc of raw bytes, never z + hex (the §5.2 challenge nonce stays opaque); to choose one, pass nonce: crypto.getRandomValues(new Uint8Array(16)). examples/world.mjs --help prints that usage, and bad arguments print it before any state is written. The next Haiku run is scored against a new snapshot.
Keeper spend.lock survives reboots and pid reuse (soak incident #1, 2026-09-24: after a reboot the old keeper's pid 1103 belonged to bluetoothd, and the keeper refused to start for 54 minutes under Restart=always until the lock was removed by hand). The lock is now two lines, the pid alone (so kill -9 $(head -n1 spend.lock) still works) and {"pid","boot_id","start"} with this boot's id and the process starttime from /proc/<pid>/stat; a held lock is taken over with one warning naming what was stale when its boot_id is not this boot's, or its pid is dead, or its pid is alive with another starttime. Two live keepers are still refused; old one-line locks keep the pid-only rules; without /proc the keeper writes the pid line only. The stale-lock takeover race (two keepers starting at the same instant) is documented as the remaining limit. 7 tests (spend 571). soak/README: Incidents section; INCIDENT.md §2.2 kill line updated.

v0.1 draft (wire `sigelo/0`) — 2026-09

First public draft. Nothing is stable.

Identity as a hashed genesis document, so the recovery commitment provably predates any compromise.
Domain-separated signing input "sigelo\n" || JCS(body); typ bound inside signed bytes.
Non-integer numbers forbidden in signed objects (JCS interop).
Recovery rotations supersede voluntary ones regardless of iat.
Voluntary rotations must carry the recovery commitment forward unchanged; only a recovery rotation may change it.
Forks under a single key are rejected, not resolved.
Cross-signed payment bindings; unproven bindings explicitly labelled and never paid to.
11 positive vector groups, 11 negative cases, verified by py/reference.py.