security: beta pre-audit fixes (combined CORE, STORAGE, SOFI)

ci/sofi_relay_is_party_neutral.sh

@@ -42,17 +42,30 @@ for entry in "${FORBIDDEN[@]}"; do
 done
 echo "  ✓ the relay holds no device state"
 
-# 2. The relay's entry points take a set and a content address, nothing more.
-for fn in relay_fulfillment relay_position_pair; do
+# 2. The relay's entry points take a set and public coordinates, nothing more:
+#    a fulfillment's content address, or the vault key an exercise holds
+#    (SoFi Amendment S20: the exercise carries everything its pair needs).
+relay_entry() {
+  local fn="$1" what="$2"; shift 2
+  local sig
   sig=$(awk "/pub async fn ${fn}\\(/{f=1} f{print} f&&/-> Result/{exit}" "$relay")
   [[ -n "$sig" ]] || { echo "[FAIL] $relay no longer defines $fn"; exit 1; }
-  if ! grep -q 'set: &StorageSet' <<<"$sig" || ! grep -q 'fulfillment_id: &D32' <<<"$sig"; then
-    echo "[FAIL] $fn no longer takes exactly (committed set, fulfillment id):"
+  for param in 'set: &StorageSet' "$@"; do
+    if ! grep -qF "$param" <<<"$sig"; then
+      echo "[FAIL] $fn no longer takes exactly ($what):"
+      echo "$sig"
+      exit 1
+    fi
+  done
+  if [[ $(grep -c ':' <<<"$(sed -n '/(/,/)/p' <<<"$sig" | grep -vE 'pub async fn')") -ne $(( $# + 1 )) ]]; then
+    echo "[FAIL] $fn takes more than ($what):"
     echo "$sig"
     exit 1
   fi
-done
-echo "  ✓ a relay is reached with a committed set and a content address"
+}
+relay_entry relay_fulfillment "committed set, fulfillment id" 'fulfillment_id: &D32'
+relay_entry relay_exercise "committed set, vault key" 'vault_id: &D32' 'parent_root: &D32' 'attempt: u64'
+echo "  ✓ a relay is reached with a committed set and public coordinates"
 
 # 3. The owner-local half still requires the owning device. A relay-shaped
 #    signature here would be the same conflation wearing the other face.

dsm_client/deterministic_state_machine/dsm/src/ccb/mod.rs

@@ -239,6 +239,10 @@ pub mod class {
     /// `𝒞_E^pre` and accepted only because it hashes to the leaf the core
     /// states.
     pub const SOFI_TRADER_PRE_BALANCE: u16 = 0x0061;
+    /// `0x0062` — `C_q` as it occupies `K_root(q)`: the derived claim and the
+    /// trader's signature over it, under a key the claim's own `AttA` binds
+    /// to its `DevID` (DSM Amendment A10, SoFi Amendment S20).
+    pub const SOFI_SIGNED_RESOLUTION_CLAIM: u16 = 0x0062;
 }
 
 /// Discriminants **allocated but not encodable** — see [`class`] for the ones

dsm_client/deterministic_state_machine/dsm/src/common/device_tree.rs

@@ -159,7 +159,10 @@ impl DevTreeProof {
             path_bits.push(bit);
         }
 
-        if offset + num_siblings * 32 != data.len() {
+        // In u64: on a 32-bit target `num_siblings * 32` wraps for a hostile
+        // count, and a wrapped length would pass this check while the copies
+        // below index past the input.
+        if offset as u64 + num_siblings as u64 * 32 != data.len() as u64 {
             return None;
         }
 
@@ -312,6 +315,21 @@ impl DeviceTree {
 mod tests {
     use super::*;
 
+    /// A proof that names more siblings than it carries is refused. The count
+    /// here is `2^27`, whose byte length `2^32` wraps to 0 on a 32-bit target,
+    /// so a length check in `usize` would accept these nine bytes there.
+    #[test]
+    fn a_proof_naming_more_siblings_than_it_carries_is_refused() {
+        assert!(
+            DevTreeProof::from_bytes(&[0x00, 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00])
+                .is_none()
+        );
+        assert!(
+            DevTreeProof::from_bytes(&[0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x00, 0x00, 0x00])
+                .is_none()
+        );
+    }
+
     #[test]
     fn test_single_device_tree() {
         let devid = [42u8; 32];

dsm_client/deterministic_state_machine/dsm/src/common/domain_tags/dsm/crypto_keys/mod.rs

@@ -41,6 +41,7 @@ pub(super) const TAGS: &[TaggedHashDomain<'static>] = &[
     TAG_DSM_ML_KEM_SEED,
     TAG_DSM_NEXT_ENTROPY,
     TAG_DSM_NONCE,
+    TAG_DSM_RELATIONSHIP_NONCE,
     TAG_DSM_PK_HASH,
     TAG_DSM_PRECOMMIT,
     TAG_DSM_PRECOMMIT_INVALIDATION_PROOF_V2,

dsm_client/deterministic_state_machine/dsm/src/common/domain_tags/dsm/crypto_keys/nonce_randomness.rs

@@ -10,5 +10,10 @@ pub const TAG_DSM_DETERMINISTIC_NONCE_32: TaggedHashDomain<'static> =
 pub const TAG_DSM_DETERMINISTIC_NONCE_GCM: TaggedHashDomain<'static> =
     crate::tagged_domain!(b"DSM/deterministic-nonce-gcm");
 pub const TAG_DSM_NONCE: TaggedHashDomain<'static> = TaggedHashDomain::from_static(b"DSM/nonce");
+/// A transfer nonce as it is spent: `H(tag ‖ relationship_key ‖ nonce)`. A
+/// nonce is unique within the relationship that carries it, so a transfer of
+/// another relationship cannot spend it.
+pub const TAG_DSM_RELATIONSHIP_NONCE: TaggedHashDomain<'static> =
+    crate::tagged_domain!(b"DSM/relationship-nonce/v1");
 pub const TAG_DSM_WALK_SEED: TaggedHashDomain<'static> = crate::tagged_domain!(b"DSM/walk-seed");
 pub const TAG_DSM_WALK_STEP: TaggedHashDomain<'static> = crate::tagged_domain!(b"DSM/walk-step");

dsm_client/deterministic_state_machine/dsm/src/common/domain_tags/dsm/misc/sofi.rs

@@ -66,6 +66,11 @@ pub const TAG_DSM_SOFI_FULFILLMENT_ID: TaggedHashDomain<'static> =
 /// `m_F = H(tag ‖ CCB(TraderFulfillmentBody))`.
 pub const TAG_DSM_SOFI_FULFILLMENT_SIGN: TaggedHashDomain<'static> =
     crate::tagged_domain!(b"DSM/sofi/fulfillment-sign/v1");
+/// `m_C = H(tag ‖ CCB(C_q) ‖ u16be(alg) ‖ u32be(|key|) ‖ key ‖ AttA)` — what
+/// the trader signs to make `C_q` an occupant of `K_root(q)` (SoFi Amendment
+/// S20).
+pub const TAG_DSM_SOFI_RESOLUTION_CLAIM_SIGN: TaggedHashDomain<'static> =
+    crate::tagged_domain!(b"DSM/sofi/resolution-claim-sign/v1");
 
 // ── Successor attempts and route outcome (F6, F7) ──────────────────────────
 
@@ -196,6 +201,7 @@ pub(crate) const SOFI_TAGS: &[TaggedHashDomain<'static>] = &[
     TAG_DSM_SOFI_FULFILLMENT,
     TAG_DSM_SOFI_FULFILLMENT_ID,
     TAG_DSM_SOFI_FULFILLMENT_SIGN,
+    TAG_DSM_SOFI_RESOLUTION_CLAIM_SIGN,
     TAG_DSM_SOFI_SUCC_CELL_V2,
     TAG_DSM_SOFI_SUCC_ATTEMPT,
     TAG_DSM_SOFI_STORAGE_SEED_V4,

dsm_client/deterministic_state_machine/dsm/src/common/domain_tags/mod.rs

@@ -171,7 +171,9 @@ mod tests {
     // network hash domain's only input.
     // +1 with the TraderPreBalance object namespace (SoFi Amendment S12).
     // +1 with the vault token locator (SoFi Amendment S16).
-    const EXPECTED_TAG_COUNT: usize = 352;
+    // +1 with the signed resolution claim's digest (SoFi Amendment S20), and
+    // +1 with the relationship-scoped transfer nonce (pre-audit item 5).
+    const EXPECTED_TAG_COUNT: usize = 354;
 
     /// Scan the crate source for every declared domain-tag constant.
     ///

dsm_client/deterministic_state_machine/dsm/src/economic/claim.rs

@@ -154,13 +154,19 @@ impl EconomicAdmissionManifest {
     }
 }
 
-/// `0x001B` schema 1 — the signed body a trader registers at its economic
+/// `0x001B` schema 2 — the signed body a trader registers at its economic
 /// position.
 ///
 /// `root_register_storage_set_id` is a member of the **signed** body, not
 /// transport context. A claim that did not commit the set it was written to
 /// could be lifted from one network's register into another's, which is
 /// precisely the substitution the network scoping exists to prevent.
+///
+/// `claimant_att_a` is the trader device's `AttA` (DSM Amendment A10): the
+/// claim proves its own authority for the cell, because `DevID = H(AK ‖ AttA)`
+/// and recognition requires `derive_devid(claimant_public_key, claimant_att_a)
+/// == trader_devid`. A key that does not derive the named device signs no
+/// claim that can occupy that device's cell.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct EconomicRootClaimBody {
     pub trader_genesis: [u8; 32],
@@ -171,11 +177,12 @@ pub struct EconomicRootClaimBody {
     pub root_register_storage_set_id: [u8; 32],
     pub signature_alg: u16,
     pub claimant_public_key: Vec<u8>,
+    pub claimant_att_a: [u8; 32],
 }
 
 impl CcbObject for EconomicRootClaimBody {
     const CLASS: u16 = class::ECONOMIC_ROOT_CLAIM_BODY;
-    const SCHEMA: u16 = 1;
+    const SCHEMA: u16 = 2;
 }
 
 impl EconomicRootClaimBody {
@@ -191,6 +198,7 @@ impl EconomicRootClaimBody {
         root_register_storage_set_id: [u8; 32],
         signature_alg: u16,
         claimant_public_key: &[u8],
+        claimant_att_a: [u8; 32],
     ) -> Result<Self, CcbError> {
         let expected = sigalg::public_key_len(signature_alg)
             .ok_or(CcbError::UnknownSignatureAlg { alg: signature_alg })?;
@@ -210,10 +218,11 @@ impl EconomicRootClaimBody {
             root_register_storage_set_id,
             signature_alg,
             claimant_public_key: claimant_public_key.to_vec(),
+            claimant_att_a,
         })
     }
 
-    /// Fields 1..8 in registry order.
+    /// Fields 1..9 in registry order.
     pub fn encode(&self) -> Result<Vec<u8>, CcbError> {
         let mut out = Vec::new();
         push_envelope::<Self>(&mut out);
@@ -225,6 +234,7 @@ impl EconomicRootClaimBody {
         push_digest32(&mut out, &self.root_register_storage_set_id); // 6
         push_u16(&mut out, self.signature_alg); // 7
         push_bytes(&mut out, &self.claimant_public_key)?; // 8
+        push_digest32(&mut out, &self.claimant_att_a); // 9
         Ok(out)
     }