Local signature decisions recovered from source and history

Research snapshot: 2026-09-12. Source inspection and tests did not change production files or lockfiles. This is a bounded reconstruction of recorded decisions, not a new signature selection or cryptographic certification.

Finding

There really was an explicit ML-DSA choice in project documents. It was subsequently removed, explicitly, in favor of proof-based authentication. The surviving native target is Hemera(secret) as identity + a Zheng proof of a programmable lock condition. The current implemented reusable signing primitives are secp256k1 ECDSA / ADR-036, for migration and browser compatibility. The newly accepted neuron working specs preserve that existing profile rather than claiming the proof-native target is already implemented.

The records do not support saying "we already finalized Falcon/ML-DSA/SLH-DSA as Cyber's optimal production signature." They do support saying "we considered ML-DSA, then deliberately chose to have proofs subsume signatures." No benchmark or proof establishing global optimality accompanies that architectural choice.

Exact chronology

Historical references use repository commit:path:line; retrieve with git -C REPOSITORY show COMMIT:PATH | nl -ba. These are historical file locations, not current workspace paths.

What the surviving choice was optimizing

The rationale recorded in /Users/master/cyber/mudra/README.md:7 and /Users/master/cyber/mudra/specs/identity.md:18 is architectural:

• Reuse the hash/VM/proof stack already needed by Cyber; avoid a separate curve or lattice signature subsystem for native authentication.
• Express ownership, multisig, timelocks, delegation and recovery as lock programs (identity.md:63).
• Prove more than ownership: include state, stake, nullifier and application predicates (identity.md:102).
• Aim to amortize larger individual proofs through recursive composition (identity.md:94).
• Use the same proof mechanism for authentication, integrity, randomness and metering (README.md:17).

These are design intentions. The listed constraint counts/proof sizes and "only collision resistance" claim are not present-day qualification evidence. Preimage authentication also requires the appropriate hash preimage assumptions, knowledge soundness and witness privacy of the proof system, and exact message/domain binding. The spec's 64 raw bytes address at identity.md:43 is stale relative to the implemented 32-byte profile. /Users/master/cyber/hemera/rs/src/params.rs:33 explicitly marks full-round security unestablished and inverse-16 experimental.

Falcon/FN-DSA, ML-DSA and SLH-DSA occur in the native identity comparison table (identity.md:22), but the conclusion is to replace a separate signature scheme, not to choose one row. /Users/master/cyber/cybics/crypto/signatures.md:13 is an educational comparison, with the proof-based alternative at line 25; it is not a Cyber protocol parameter decision.

Keep four meanings separate

BBG does not select or implement a signature scheme: /Users/master/cyber/bbg/rs/src/signal.rs:36 explicitly delegates semantic/authentication validation to Cybergraph. /Users/master/cyber/bbg/specs/privacy.md:24 distinguishes private ownership proofs from the public auth signature path at line 29 without naming a family. A 64-byte intent signature field in bbg/specs/native-state.md:56 likewise is not evidence of selecting a PQ signature.

Zheng readiness relevant to that decision

1. The old Mudra proving entry point is not native authentication. /Users/master/cyber/mudra/src/proof/prove.rs:18 says full claim assembly remains; line 82 proves only a*b+c; line 35 builds an unbound statement. The current prove feature does not compile because that initializer omits bbg_root (reproduced below). Native secp verification is available; a complete Zheng proof of the migration claim is not.

2. Legacy Zheng commit/verify must not be used to conclude that the claimed identity/action was authorized. /Users/master/cyber/zheng/README.md:5 explicitly states these remain legacy statement checks. /Users/master/cyber/zheng/rs/src/folding/fold.rs:343 and :391 contain passing attack regressions: an all-zero witness and a genuine but unrelated quote witness respectively verify against arbitrary chosen statement values. Both tests still pass in this snapshot. Absorbing statement bytes into a transcript binds the proof to those bytes; it does not establish the missing relation between witness, program and statement. The documented residual is /Users/master/cyber/zheng/specs/decider.md:111.

3. A newer public execution path does establish a bounded relation, but exposes the witness. /Users/master/cyber/zheng/rs/src/execution/statement.rs:93 derives the relation from the canonical program; :119 pins public inputs/outputs/cost; :153 serializes the program, inputs, outputs, cost and budget; :241 rederives the relation at verification. /Users/master/cyber/zheng/rs/src/execution/proof.rs:5 explicitly says this path discloses witness-dependent information. It cannot privately authenticate a reusable secret merely by running a preimage lock through the public API.

4. Concurrent private-proof work is real and must not be omitted. The untracked /Users/master/cyber/zheng/rs/src/execution/private.rs:42 prepares the private relation and witness; /Users/master/cyber/trisha/rs/ccs.rs:93 generates an actual randomized upstream Triton proof of a generated CCS checker, and :119 checks the expected program/input/output before native proof verification. The untracked /Users/master/cyber/joy/rs/zk_execution.rs:39 binds statement/build/program metadata; :83 independently prepares the expected relation and checker. These are distinct from the legacy folded API. /Users/master/cyber/zheng/specs/ccs-execution-backends.md:3 calls this an owner-authorized release-repair contract. This research inspected the path but did not run a Triton proof or certify it. It has not supplied a versioned Mudra identity/action authorization profile.

5. The native authorization statement still needs a complete application contract. mudra/specs/identity.md:49 only shows a preimage assertion. Its anonymous-link sketch includes source/target/nullifier/state public inputs at line 108, but it is not an encoded operation authorization protocol with network and replay rules. The new neuron spec requires exact action/network/prog binding at line 45; the generic Zheng execution statement has no implicit notion of a neuron or network. A Mudra profile must explicitly put those meanings into the verifier's expected statement/program and reject substitutions. This is a concrete missing integration contract, not evidence that proof-based authentication is impossible.

Commands and observed results

All commands used --locked --offline and a separate target directory; no source changes were made.

cd /Users/master/cyber/zheng
cargo test --locked --offline --target-dir /tmp/zheng-signature-research-target \
  -p zheng --lib attack_ -- --nocapture

Result: 2 passed, 0 failed, 175 filtered. These are intentionally passing attack demonstrations, not evidence of production security:

• folding::fold::tests::attack_zeroed_constant_wire_satisfies_universal_instance
• folding::fold::tests::attack_satisfying_but_meaningless_witness_passes_for_any_statement

cargo test --locked --offline --target-dir /tmp/zheng-signature-research-target \
  -p zheng --lib execution::budget_tests::public_cost_budget_and_selected_branch_are_authenticated \
  -- --nocapture

Result: 1 passed, 0 failed, 176 filtered. This current working-tree regression checks public execution claim binding; it is not a private identity proof test.

cd /Users/master/cyber/mudra
cargo test --locked --offline --target-dir /tmp/mudra-id-research-target \
  --features prove --lib --test vectors

Result: exit 101, Rust E0063, missing bbg_root in Statement at src/proof/prove.rs:36.

Earlier same-day native Mudra checks are preserved in the readiness report: 18 library + 2 vector tests pass by default, 15 library tests without default features. That earlier review's external emulation probe is not an actual claim proof and must not be described as one.

Search coverage and limits

Current source/docs and hidden plan files were searched in mudra, soft3, cyber/research, bbg, zheng, crystal, and cybics, excluding .git, build artifacts, dependencies and today's new Quantus audit. A supplemental current Markdown search in cyb found no conventional PQ-family matches. Scheme terms included Lamport signatures, Winternitz/WOTS, Falcon/FN-DSA, ML-DSA/MLDSA/Dilithium, SLH-DSA/SLHDSA/SPHINCS and hash-based signatures. The original broad Lamport hits were logical-clock/consensus references, not signatures.

Additionally, git log --all -G... -- '*.md' ':(exclude)audit/**' searched retained histories of mudra, cyber (all Markdown, including old graph/root locations), bbg, soft3, zheng, crystal, and cybics; relevant commits were opened with git show. git log --all --follow -- specs/identity.md traced Cybergraph→Mudra movement. This deeper history is what recovered the subsequently removed ML-DSA selections; a current-tree-only search would have missed them.

No surviving finalized Lamport/WOTS/XMSS/LMS/Falcon/SLH-DSA production selection was found in this coverage. Generic XMSS/LMS references occur in /Users/master/cyber/cybics/crypto/features.md:146. Today's /Users/master/cyber/mudra/audit/quantus-identity-privacy.md at commit 3dd6f3d is new comparative research, not historical evidence that its conditional ML-DSA suggestion was already chosen.

Snapshot heads and concurrent changes

Mudra had pre-existing modifications to Cargo.toml, Cargo.lock, claim.rs, domain.rs and vectors.rs. Neuron/Soft3 identity work and Zheng/Trisha/Joy private execution work are concurrent and extensively dirty/untracked. Working-tree line references above describe the inspected snapshot, not a claim that those lines exist at the listed HEADs. None of that work was edited, staged, reverted or committed by this research.

Priority implications for the parent decision

1. Start from the recovered native target; do not accidentally promote today's conventional-signature comparison into a replacement architecture without an explicit decision.
2. Separate the product question "which cheap transport/operation signature do we need now?" from the native proof-based ownership target. The project has already used that separation for browser secp256k1 and legacy migration.
3. Before claiming native proof authentication ready, define the exact versioned identity/action profile and qualify the real private proving/verifying route. Legacy folded Zheng verification and the public witness-disclosing certificate are unsuitable substitutes.
4. Preserve existing H(pubkey) identities. A future H(secret), lock-program commitment or PQ-key identity needs an explicit profile and authorized migration/recovery policy, not reinterpretation of existing 32-byte values.