Mudra authorization and private recovery: canonical contract review

Read-only review, 2026-09-12. References are paths relative to /Users/master/cyber, followed by local line numbers. Mudra HEAD 73f9daba2b85dbadf490c9bcb0f137313b23aa85; BBG a25039d54d0671c70c11aed2c9efc8266c371e8b; Cybergraph fa289ea46e7bafe46daea9319ad6531b31ace2cd. Working-tree canonical documents were read as present, including concurrent Neuron specifications. No workspace files changed. This is a design review, not an implementation-readiness verdict.

The Mudra contract findings below are addressed by the accompanying specification revision. Line numbers refer to the pre-revision snapshot above. BBG findings remain integration work, summarized in the research index.

Mudra findings addressed by this revision

1. Specify authorization of an action, not merely knowledge of a key. Replace mudra/README.md:9–13 and mudra/specs/identity.md:9–16,49–59 with a versioned statement: the accepted authorization program proves the required owner/policy relation for the exact canonical action, network/genesis, subject or private ownership commitment, policy revision, replay/nullifier scope and applicable state anchor. The verifier pins that relation and checks those bindings. Simply appending an unconstrained message hash to proof metadata is insufficient. A preimage proof alone is not a signature on every possible message; proof of correct execution is not proof of delivery. A VRF also needs a specified unique-output and randomness security contract.

2. Keep identifier/profile boundaries explicit. identity.md:43 says 64-byte addresses; current neuron/specs/identity.md:9,21–24 specifies a 32-byte H(valid compressed secp256k1 public key) identifier. The strategic proof-native H(secret) profile must not silently reinterpret that existing subject. Neuron already says replacing the public key changes that key-derived subject unless a separate recovery protocol exists (:34–40). Distinguish root subject, authorization credential, viewing key and request idempotency key. Rotation preserving a stable subject requires an authenticated policy/key-binding transition, not changing the preimage of an immutable hash.

3. State assumptions and privacy accurately. Remove “only collision resistance” (identity.md:31,250–251): ownership requires appropriate preimage security plus the selected proof system's soundness/knowledge and zero-knowledge properties and its transcript/security model. Replace the public-per-link-weight circuit (:108–139) and stale AOCL/SWBF account (:134–155) with a link to BBG's current private-output/aggregate contract. Individual weights cannot simultaneously be explicit public inputs and confidential. Replace disclosure of an unspecified secret-derived path (:170) with a scoped authorship-proof contract that never reveals spending/master secrets. Quantitative proof/constraint costs remain profile-qualified estimates until measured.

4. Separate NIKE, encryption and exclusive spending authority. In stealth.md and identity.md:216–244, define ephemeral announcement R=[r]E0, recipient public viewing key B=[b]E0, and shared result [r]B=[b]R; keep r secret, validate peer public keys and bind the KDF to the profile/context. The sender knows this shared result. It can protect the note payload or authenticate a pairwise channel, but cannot be the sole secret authorizing recipient spending. Spending must additionally require the recipient's independent secret/policy. Sender possession of a viewing/shared secret must never grant spending authority. NIKE alone does not hide network metadata, give key rotation or provide forward secrecy.

5. Resolve the already-researched parameter misstatements. seal.md:8,20–25,55–71 conflates the custom degree-64 Goldilocks sketch with FIPS 203 ML-KEM; separate named profiles and qualify standard status only for the exact standard. Publishing a recipient key does not require an online round trip. stealth.md:43–53 must correct dCTIDH's “d” to deterministic and remove its unsupported security-bit ladder and universal raw-key sizes; BBG explicitly selects CSIDH-512 (bbg/specs/privacy.md:212) while Mudra's target set/security model remains unresolved. Remove ~5x (seal.md:68, identity.md:244). Reuse the primary-source citations in /tmp/mudra-revision-20260912/mudra-design.md; no new cryptographic selection is implied here.

Recovery contract to establish

The accepted architecture is already well separated in cybergraph/docs/private-retrieval.md:41–52,60–124,134–152 and inf/specs/proof.md:78–95: complete ciphertext computation over a pinned authenticated board, with local recipient decryption; proofs for both detection and retrieval; explicit error/capacity/leakage limits. Link it from Mudra and make Mudra own a versioned recoverable note and retrieval profile, not a second query engine.

That profile must specify the authenticated association between announcement, clue, encrypted note and committed output; sender clue validity; encrypted recovery contents; key/profile epochs; permitted disclosure; whole-recovery failure budget; padded overflow/continuation; and the material required to move from discovered note to currently spendable note. The encrypted note must carry or let the legitimate recipient derive every otherwise unavailable opening secret and field needed to spend. A seed cannot regenerate a sender's independently random rho or nonce without such material. BBG currently says rho was stored at wallet creation (neuron-state.md:212), later describes decrypting the value commitment with sk_spend (:228–232), and elsewhere says values require rho (privacy.md:165–166,306): settle this as an explicit note format, not an implicit decryption capability.

Fundamental boundaries and conflicting BBG sketch

• Public aggregates leak deltas. BBG publishes per-block particle energies and axon weights while claiming individual changes are private (privacy.md:58–61,75–83,95,253; Mudra identity.md:165–166). In a block with one update to an observed edge, W_after-W_before reveals that update's net contribution. Proofs cannot conceal a disclosed output. Privacy must state leakage from successive aggregates, sparse batches and side information; batching alone provides no universal anonymity guarantee.

• Committed history is not retained history. privacy.md:191–195 resets A/N each epoch and :290 promises non-expiring boxes via archived roots. A root or folded validity proof does not supply historical ciphertexts, record preimages, polynomial opening material or an old note's current unspentness witness. data-availability.md:159 expressly limits active-window guarantees; later data relies on archives. temporal.md:142–144 must not be read as unlimited history recoverable from a constant-size commitment. Define durable availability of the recovery board/payloads, historical membership data and authenticated cross-epoch spent status. A valid old unspent snapshot is not current unspentness.

• The earlier bbg/specs/neuron-state.md is not the ciphertext-only recovery protocol. Its viewing-key delegation (:36,154–170,215) hides the key from proof verifiers, not the service that possesses the proving witness. This is a separately labeled trusted viewing service or a user's own device. Its GCD service takes only commit(Q) yet assumes it can compute the hidden polynomial (:102–118); a commitment alone provides no such encrypted-evaluation protocol. Its checks prove only a common divisor, so G=1 passes even when matches exist (:114–116). Its proposed PIR sums polynomial evaluations at additive query shares (:242–247), which does not equal evaluation at their sum for a general polynomial. The claims “owned-count leakage unavoidable” (:135) and “backward-compatible” consensus-root additions (:285–287) also need explicit profile/protocol qualification. Supersede these construction sketches and link the accepted Cybergraph/Inf contract rather than importing them into Mudra.

Proposals for exceptional recovery, clearly not yet selected constructions

1. One verified recovery session, three explicit states: complete discovery through checkpoint; current unspent balance; spend-ready witnesses. Privately compose the necessary queries, so the UI never turns “found notes” into “spendable” prematurely. Persist verified outputs and the contiguous epoch/key-scope cursor atomically; support reorg rollback.
2. Encrypted portable recovery capsule: profile and key-epoch map, authenticated birth/checkpoint hint, cursor, note/opening cache and spending-policy descriptors. It accelerates device replacement; seed-only restoration remains possible through retained encrypted chain data. Capsule loss must not make legitimately received notes undiscoverable. Capsule freshness/rollback and its retrieval access pattern are part of the contract.
3. Separate cold restore from cheap catch-up: reusable public authenticated board preprocessing plus padded per-wallet private queries; incremental proved scopes and portable verified checkpoints. Reuse public work without creating a stable recipient identifier. Compare whole-recovery cost, not just verifier time.
4. Make archives part of the wallet guarantee: advertise proved history coverage and independent replicas; expose unavailable epochs explicitly and never silently advance completion. Current spent-status queries and witness refresh belong in the same privacy envelope. Key deletion/forward secrecy, late payments and recovery of historical viewing keys require an explicit tradeoff; no automatic scheme supplies all three.

Evidence collection: bounded nl -ba ... | sed -n ... reads of the cited canonical files, rg across related recovery/identity contracts, and git rev-parse HEAD. No benchmarks, implementation changes or test runs were appropriate for this contract-only review.