Spectra stands alone: its own identities, signatures and CBOR; projects of any kind of work (#26, #27) 98a0fb9f0948

//! Deterministic CBOR (RFC 8949 §4.2), as much of it as Spectra encodes:

//! unsigned integers, byte and text strings, arrays, maps with integer

//! keys, null and booleans. Shortest forms, definite lengths, map keys in

//! ascending order; the decoder refuses anything else, so one value has

//! exactly one encoding and hashing it is meaningful (spec §9.5).

use std::collections::BTreeMap;

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum Value {

    Uint(u64),

    Bytes(Vec<u8>),

    Text(String),

    Array(Vec<Value>),

    Map(BTreeMap<u64, Value>),

    Bool(bool),

    Null,

}

impl Value {

    pub fn map<const N: usize>(entries: [(u64, Value); N]) -> Value {

        Value::Map(entries.into_iter().collect())

    }

    pub fn as_uint(&self) -> Option<u64> {

        match self {

            Value::Uint(u) => Some(*u),

            _ => None,

        }

    }

    pub fn as_bytes(&self) -> Option<&[u8]> {

        match self {

            Value::Bytes(b) => Some(b),

            _ => None,

        }

    }

    pub fn as_text(&self) -> Option<&str> {

        match self {

            Value::Text(t) => Some(t),

            _ => None,

        }

    }

    pub fn as_array(&self) -> Option<&[Value]> {

        match self {

            Value::Array(a) => Some(a),

            _ => None,

        }

    }

    pub fn as_map(&self) -> Option<&BTreeMap<u64, Value>> {

        match self {

            Value::Map(m) => Some(m),

            _ => None,

        }

    }

    pub fn is_null(&self) -> bool {

        matches!(self, Value::Null)

    }

}

fn head(out: &mut Vec<u8>, major: u8, n: u64) {

    let m = major << 5;

    match n {

        0..=23 => out.push(m | n as u8),

        24..=0xff => out.extend_from_slice(&[m | 24, n as u8]),

        0x100..=0xffff => {

            out.push(m | 25);

            out.extend_from_slice(&(n as u16).to_be_bytes());

        }

        0x1_0000..=0xffff_ffff => {

            out.push(m | 26);

            out.extend_from_slice(&(n as u32).to_be_bytes());

        }

        _ => {

            out.push(m | 27);

            out.extend_from_slice(&n.to_be_bytes());

        }

    }

}

fn put(out: &mut Vec<u8>, v: &Value) {

    match v {

        Value::Uint(n) => head(out, 0, *n),

        Value::Bytes(b) => {

            head(out, 2, b.len() as u64);

            out.extend_from_slice(b);

        }

        Value::Text(t) => {

            head(out, 3, t.len() as u64);

            out.extend_from_slice(t.as_bytes());

        }

        Value::Array(a) => {

            head(out, 4, a.len() as u64);

            for x in a {

                put(out, x);

            }

        }

        // BTreeMap iterates keys ascending, which for unsigned integers is

        // the order of their shortest encodings.

        Value::Map(m) => {

            head(out, 5, m.len() as u64);

            for (k, x) in m {

                head(out, 0, *k);

                put(out, x);

            }

        }

        Value::Bool(false) => out.push(0xf4),

        Value::Bool(true) => out.push(0xf5),

        Value::Null => out.push(0xf6),

    }

}

pub fn encode(v: &Value) -> Vec<u8> {

    let mut out = Vec::new();

    put(&mut out, v);

    out

}

/// Why bytes are not a value Spectra encodes.

#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]

#[error("malformed CBOR: {0}")]

pub struct Error(pub String);

struct Reader<'a> {

    b: &'a [u8],

    at: usize,

    depth: usize,

}

const MAX_DEPTH: usize = 32;

impl<'a> Reader<'a> {

    fn take(&mut self, n: usize) -> Result<&'a [u8], Error> {

        let end = self.at.checked_add(n).filter(|e| *e <= self.b.len()).ok_or_else(|| Error("truncated".into()))?;

        let s = &self.b[self.at..end];

        self.at = end;

        Ok(s)

    }

    fn head(&mut self) -> Result<(u8, u64), Error> {

        let first = self.take(1)?[0];

        let (major, info) = (first >> 5, first & 0x1f);

        let n = match info {

            0..=23 => info as u64,

            24 => self.take(1)?[0] as u64,

            25 => u16::from_be_bytes(self.take(2)?.try_into().unwrap()) as u64,

            26 => u32::from_be_bytes(self.take(4)?.try_into().unwrap()) as u64,

            27 => u64::from_be_bytes(self.take(8)?.try_into().unwrap()),

            _ if major == 7 => return Ok((7, info as u64)),

            _ => return Err(Error("an indefinite length or a reserved form".into())),

        };

        let minimal = match info {

            24 => n >= 24,

            25 => n > 0xff,

            26 => n > 0xffff,

            27 => n > 0xffff_ffff,

            _ => true,

        };

        if !minimal && major != 7 {

            return Err(Error("a length or number not in its shortest form".into()));

        }

        Ok((major, n))

    }

    fn len(&mut self, n: u64) -> Result<usize, Error> {

        let n = usize::try_from(n).map_err(|_| Error("too long".into()))?;

        if n > self.b.len() - self.at {

            return Err(Error("truncated".into()));

        }

        Ok(n)

    }

    fn value(&mut self) -> Result<Value, Error> {

        self.depth += 1;

        if self.depth > MAX_DEPTH {

            return Err(Error("nested too deeply".into()));

        }

        let (major, n) = self.head()?;

        let v = match major {

            0 => Value::Uint(n),

            2 => {

                let l = self.len(n)?;

                Value::Bytes(self.take(l)?.to_vec())

            }

            3 => {

                let l = self.len(n)?;

                Value::Text(String::from_utf8(self.take(l)?.to_vec()).map_err(|_| Error("text that is not UTF-8".into()))?)

            }

            4 => {

                let l = self.len(n)?;

                let mut a = Vec::with_capacity(l);

                for _ in 0..l {

                    a.push(self.value()?);

                }

                Value::Array(a)

            }

            5 => {

                let l = self.len(n)?;

                let mut m = BTreeMap::new();

                let mut last: Option<u64> = None;

                for _ in 0..l {

                    let (km, k) = self.head()?;

                    if km != 0 {

                        return Err(Error("a map key that is not an unsigned integer".into()));

                    }

                    if last.is_some_and(|p| k <= p) {

                        return Err(Error("map keys out of order or repeated".into()));

                    }

                    last = Some(k);

                    m.insert(k, self.value()?);

                }

                Value::Map(m)

            }

            7 => match n {

                20 => Value::Bool(false),

                21 => Value::Bool(true),

                22 => Value::Null,

                _ => return Err(Error("an unsupported simple value or float".into())),

            },

            _ => return Err(Error("a negative integer or a tag".into())),

        };

        self.depth -= 1;

        Ok(v)

    }

}

/// Decode exactly one value, refusing any non-canonical encoding.

pub fn decode(b: &[u8]) -> Result<Value, Error> {

    let mut r = Reader { b, at: 0, depth: 0 };

    let v = r.value()?;

    if r.at != b.len() {

        return Err(Error("bytes after the value".into()));

    }

    Ok(v)

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn round_trips_and_known_encodings() {

        let v = Value::map([

            (0, Value::Uint(1)),

            (1, Value::Text("é".into())),

            (2, Value::Bytes(vec![1, 2])),

            (3, Value::Array(vec![Value::Null, Value::Bool(true), Value::Uint(500)])),

            (24, Value::Uint(u64::MAX)),

        ]);

        let b = encode(&v);

        assert_eq!(decode(&b).unwrap(), v);

        assert_eq!(encode(&Value::Uint(23)), [0x17]);

        assert_eq!(encode(&Value::Uint(24)), [0x18, 24]);

        assert_eq!(encode(&Value::Uint(1000)), [0x19, 0x03, 0xe8]);

        assert_eq!(encode(&Value::Text("a".into())), [0x61, b'a']);

    }

    #[test]

    fn refuses_what_is_not_canonical() {

        assert!(decode(&[0x18, 5]).is_err(), "5 in two bytes");

        assert!(decode(&[0xa2, 0x01, 0x00, 0x00, 0x00]).is_err(), "keys out of order");

        assert!(decode(&[0x5f]).is_err(), "indefinite length");

        assert!(decode(&[0x01, 0x02]).is_err(), "trailing bytes");

        assert!(decode(&[0x5a, 0xff, 0xff, 0xff, 0xff]).is_err(), "truncated");

        assert!(decode(&[0x20]).is_err(), "negative");

        let deep = [0x81u8; 64];

        assert!(decode(&deep).is_err(), "too deep");

    }

}

//! Writing files so a crash leaves the old content or the new, never half:

//! a temporary file in the same directory, flushed, then renamed over.

use std::io::Write;

use std::path::Path;

fn write(path: &Path, bytes: &[u8], private: bool) -> std::io::Result<()> {

    let dir = path.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(Path::new("."));

    std::fs::create_dir_all(dir)?;

    let name = path.file_name().and_then(|n| n.to_str()).unwrap_or("file");

    let tmp = dir.join(format!(".{name}.{}.tmp", std::process::id()));

    let mut opts = std::fs::OpenOptions::new();

    opts.write(true).create(true).truncate(true);

    #[cfg(unix)]

    {

        use std::os::unix::fs::OpenOptionsExt;

        opts.mode(if private { 0o600 } else { 0o644 });

    }

    #[cfg(not(unix))]

    let _ = private;

    let mut f = opts.open(&tmp)?;

    f.write_all(bytes)?;

    f.sync_all()?;

    drop(f);

    std::fs::rename(&tmp, path)?;

    if let Ok(d) = std::fs::File::open(dir) {

        let _ = d.sync_all();

    }

    Ok(())

}

pub fn write_atomic(path: &Path, bytes: &[u8]) -> std::io::Result<()> {

    write(path, bytes, false)

}

/// As [`write_atomic`], readable by its owner only.

pub fn write_atomic_private(path: &Path, bytes: &[u8]) -> std::io::Result<()> {

    write(path, bytes, true)

}

//! Spectra's identities and composite signatures (spec §8.0).

//!

//! An identity is a composite key pair, Ed25519 and ML-DSA-65, with a name,

//! the identity it succeeds and the keys it delegates to. Both halves sign

//! the same target and both must verify, so a signature stays sound while

//! either algorithm does. The design follows the lessons of Oxygen's

//! identities; the code, encoding and files are Spectra's own.

use crate::cbor::{self, Value};

use ed25519_dalek::ed25519::signature::Signer as _;

use ed25519_dalek::{Signature as EdSignature, SigningKey as EdSigningKey, VerifyingKey as EdVerifyingKey};

use ml_dsa::{

    EncodedSignature, EncodedVerifyingKey, MlDsa65, Seed, Signature as MlSignature, SigningKey as MlSigningKey,

    VerifyingKey as MlVerifyingKey,

};

use rand::RngCore;

const VERSION: u64 = 1;

/// An identity's name: `BLAKE3("spectra1 identity " || encoding)`.

#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]

pub struct KeyId(pub [u8; 32]);

impl KeyId {

    pub fn to_hex(&self) -> String {

        hex::encode(self.0)

    }

    pub fn from_hex(s: &str) -> Option<KeyId> {

        hex::decode(s.trim()).ok()?.try_into().ok().map(KeyId)

    }

    /// The first `n` hex digits, for display.

    pub fn short(&self, n: usize) -> String {

        let h = self.to_hex();

        h[..n.min(h.len())].to_string()

    }

}

impl std::fmt::Debug for KeyId {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        write!(f, "KeyId({})", self.short(12))

    }

}

impl std::fmt::Display for KeyId {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        f.write_str(&self.to_hex())

    }

}

/// A key an identity lets act for it, until `expires` if set (ms).

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Delegate {

    pub key: KeyId,

    pub expires: Option<u64>,

}

impl Delegate {

    pub fn allows(&self, at_ms: u64) -> bool {

        self.expires.is_none_or(|e| at_ms < e)

    }

}

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Identity {

    pub ed25519_pk: [u8; 32],

    pub mldsa65_pk: Vec<u8>,

    pub name: String,

    pub contact: String,

    pub created: u64,

    pub expires: Option<u64>,

    pub previous: Option<KeyId>,

    pub delegates: Vec<Delegate>,

}

/// Why an identity, a secret or a signature could not be read or checked.

#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]

pub enum Error {

    #[error(transparent)]

    Cbor(#[from] cbor::Error),

    #[error("{0}")]

    Shape(String),

    #[error("the signature is by another key")]

    KeyMismatch,

    #[error("a public key that does not decode")]

    BadKey,

    #[error("the Ed25519 half does not verify")]

    Ed25519,

    #[error("the ML-DSA-65 half does not verify")]

    MlDsa,

}

fn shape(s: &str) -> Error {

    Error::Shape(s.into())

}

fn bytes_of(v: Option<&Value>, what: &str) -> Result<Vec<u8>, Error> {

    v.and_then(Value::as_bytes).map(|b| b.to_vec()).ok_or_else(|| shape(what))

}

fn key_of(v: Option<&Value>, what: &str) -> Result<KeyId, Error> {

    bytes_of(v, what)?.try_into().map(KeyId).map_err(|_| shape(what))

}

fn opt_uint(v: Option<&Value>, what: &str) -> Result<Option<u64>, Error> {

    match v {

        None | Some(Value::Null) => Ok(None),

        Some(Value::Uint(u)) => Ok(Some(*u)),

        _ => Err(shape(what)),

    }

}

fn opt_val<T>(o: Option<T>, f: impl Fn(T) -> Value) -> Value {

    o.map(f).unwrap_or(Value::Null)

}

impl Identity {

    pub fn to_value(&self) -> Value {

        Value::map([

            (0, Value::Uint(VERSION)),

            (1, Value::Bytes(self.ed25519_pk.to_vec())),

            (2, Value::Bytes(self.mldsa65_pk.clone())),

            (3, Value::Text(self.name.clone())),

            (4, Value::Text(self.contact.clone())),

            (5, Value::Uint(self.created)),

            (6, opt_val(self.expires, Value::Uint)),

            (7, opt_val(self.previous, |k| Value::Bytes(k.0.to_vec()))),

            (

                8,

                Value::Array(

                    self.delegates

                        .iter()

                        .map(|d| Value::map([(0, Value::Bytes(d.key.0.to_vec())), (1, opt_val(d.expires, Value::Uint))]))

                        .collect(),

                ),

            ),

        ])

    }

    pub fn encode(&self) -> Vec<u8> {

        cbor::encode(&self.to_value())

    }

    pub fn hash(&self) -> KeyId {

        let mut h = blake3::Hasher::new();

        h.update(b"spectra1 identity ");

        h.update(&self.encode());

        KeyId(*h.finalize().as_bytes())

    }

    pub fn decode(b: &[u8]) -> Result<Identity, Error> {

        let v = cbor::decode(b)?;

        let m = v.as_map().ok_or_else(|| shape("an identity is a map"))?;

        if m.get(&0).and_then(Value::as_uint) != Some(VERSION) {

            return Err(shape("an identity of an unknown version"));

        }

        let text = |k: u64, what: &str| m.get(&k).and_then(Value::as_text).map(String::from).ok_or_else(|| shape(what));

        let delegates = m

            .get(&8)

            .and_then(Value::as_array)

            .ok_or_else(|| shape("delegates"))?

            .iter()

            .map(|d| {

                let dm = d.as_map().ok_or_else(|| shape("a delegate is a map"))?;

                Ok(Delegate { key: key_of(dm.get(&0), "a delegate's key")?, expires: opt_uint(dm.get(&1), "a delegate's expiry")? })

            })

            .collect::<Result<Vec<_>, Error>>()?;

        let id = Identity {

            ed25519_pk: bytes_of(m.get(&1), "the Ed25519 key")?.try_into().map_err(|_| shape("the Ed25519 key"))?,

            mldsa65_pk: bytes_of(m.get(&2), "the ML-DSA-65 key")?,

            name: text(3, "the name")?,

            contact: text(4, "the contact")?,

            created: m.get(&5).and_then(Value::as_uint).ok_or_else(|| shape("the creation time"))?,

            expires: opt_uint(m.get(&6), "the expiry")?,

            previous: match m.get(&7) {

                None | Some(Value::Null) => None,

                v => Some(key_of(v, "the previous identity")?),

            },

            delegates,

        };

        // One identity, one encoding: what was read must be what we write.

        if id.encode() != b {

            return Err(shape("an identity not in Spectra's own encoding"));

        }

        Ok(id)

    }

    pub fn delegate(&self, key: &KeyId) -> Option<&Delegate> {

        self.delegates.iter().find(|d| &d.key == key)

    }

    /// Whether this identity lets `key` act for it at `at_ms`.

    pub fn delegates_to(&self, key: &KeyId, at_ms: u64) -> bool {

        !self.is_expired_at(at_ms) && self.delegate(key).is_some_and(|d| d.allows(at_ms))

    }

    pub fn is_expired_at(&self, at_ms: u64) -> bool {

        self.expires.is_some_and(|e| at_ms >= e)

    }

    /// The next identity: the same key pair with these delegates.

    pub fn successor(&self, delegates: Vec<Delegate>, expires: Option<u64>, created: u64) -> Identity {

        Identity { delegates, expires, created, previous: Some(self.hash()), ..self.clone() }

    }

    fn ed_key(&self) -> Result<EdVerifyingKey, Error> {

        EdVerifyingKey::from_bytes(&self.ed25519_pk).map_err(|_| Error::BadKey)

    }

    fn ml_key(&self) -> Result<MlVerifyingKey<MlDsa65>, Error> {

        let enc = EncodedVerifyingKey::<MlDsa65>::try_from(self.mldsa65_pk.as_slice()).map_err(|_| Error::BadKey)?;

        Ok(MlVerifyingKey::decode(&enc))

    }

}

/// What both halves sign: the signer's KeyId and the message, under

/// Spectra's prefix, so a signature means one thing by one key.

fn target(key: &KeyId, message: &[u8]) -> [u8; 32] {

    let mut h = blake3::Hasher::new();

    h.update(b"spectra1 sign ");

    h.update(&key.0);

    h.update(message);

    *h.finalize().as_bytes()

}

#[derive(Clone, PartialEq, Eq)]

pub struct Signature {

    pub key: KeyId,

    pub ed: [u8; 64],

    pub ml: Vec<u8>,

}

impl std::fmt::Debug for Signature {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        write!(f, "Signature({:?})", self.key)

    }

}

impl Signature {

    pub fn to_value(&self) -> Value {

        Value::map([(0, Value::Bytes(self.key.0.to_vec())), (1, Value::Bytes(self.ed.to_vec())), (2, Value::Bytes(self.ml.clone()))])

    }

    pub fn from_value(v: &Value) -> Result<Signature, Error> {

        let m = v.as_map().ok_or_else(|| shape("a signature is a map"))?;

        Ok(Signature {

            key: key_of(m.get(&0), "the signature's key")?,

            ed: bytes_of(m.get(&1), "the Ed25519 signature")?.try_into().map_err(|_| shape("the Ed25519 signature"))?,

            ml: bytes_of(m.get(&2), "the ML-DSA-65 signature")?,

        })

    }

    pub fn encode(&self) -> Vec<u8> {

        cbor::encode(&self.to_value())

    }

    pub fn decode(b: &[u8]) -> Result<Signature, Error> {

        Signature::from_value(&cbor::decode(b)?)

    }

}

/// Check a signature by `identity` over `message`.

pub fn verify(identity: &Identity, sig: &Signature, message: &[u8]) -> Result<(), Error> {

    let key = identity.hash();

    if sig.key != key {

        return Err(Error::KeyMismatch);

    }

    let t = target(&key, message);

    identity.ed_key()?.verify_strict(&t, &EdSignature::from_bytes(&sig.ed)).map_err(|_| Error::Ed25519)?;

    let enc = EncodedSignature::<MlDsa65>::try_from(sig.ml.as_slice()).map_err(|_| Error::MlDsa)?;

    let ml = MlSignature::<MlDsa65>::decode(&enc).ok_or(Error::MlDsa)?;

    if !identity.ml_key()?.verify_with_context(&t, b"", &ml) {

        return Err(Error::MlDsa);

    }

    Ok(())

}

/// The seeds of a key pair; stored only in its identity home, 0600.

#[derive(Clone)]

pub struct SecretKey {

    ed_seed: [u8; 32],

    ml_seed: [u8; 32],

}

impl std::fmt::Debug for SecretKey {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        f.write_str("SecretKey(..)")

    }

}

impl SecretKey {

    pub fn generate() -> SecretKey {

        let (mut ed_seed, mut ml_seed) = ([0u8; 32], [0u8; 32]);

        rand::rngs::OsRng.fill_bytes(&mut ed_seed);

        rand::rngs::OsRng.fill_bytes(&mut ml_seed);

        SecretKey { ed_seed, ml_seed }

    }

    fn ed(&self) -> EdSigningKey {

        EdSigningKey::from_bytes(&self.ed_seed)

    }

    fn ml(&self) -> MlSigningKey<MlDsa65> {

        MlSigningKey::from_seed(&Seed::from(self.ml_seed))

    }

    /// The identity of this key pair, delegating to nobody.

    pub fn identity(&self, name: &str, contact: &str, created: u64) -> Identity {

        Identity {

            ed25519_pk: self.ed().verifying_key().to_bytes(),

            mldsa65_pk: self.ml().expanded_key().verifying_key().encode().as_slice().to_vec(),

            name: name.into(),

            contact: contact.into(),

            created,

            expires: None,

            previous: None,

            delegates: vec![],

        }

    }

    /// Sign `message` as the identity named `key` (this key pair's).

    pub fn sign(&self, key: &KeyId, message: &[u8]) -> Signature {

        let t = target(key, message);

        let ed = self.ed().sign(&t).to_bytes();

        let ml = self.ml().expanded_key().sign_deterministic(&t, b"").expect("an empty context is valid").encode().as_slice().to_vec();

        Signature { key: *key, ed, ml }

    }

    /// Whether this is the key pair of `identity`.

    pub fn matches(&self, identity: &Identity) -> bool {

        let mine = self.identity("", "", 0);

        mine.ed25519_pk == identity.ed25519_pk && mine.mldsa65_pk == identity.mldsa65_pk

    }

    pub fn encode(&self, key: &KeyId) -> Vec<u8> {

        cbor::encode(&Value::map([

            (0, Value::Uint(VERSION)),

            (1, Value::Bytes(key.0.to_vec())),

            (2, Value::Bytes(self.ed_seed.to_vec())),

            (3, Value::Bytes(self.ml_seed.to_vec())),

        ]))

    }

    pub fn decode(b: &[u8]) -> Result<(KeyId, SecretKey), Error> {

        let v = cbor::decode(b)?;

        let m = v.as_map().ok_or_else(|| shape("a secret key is a map"))?;

        if m.get(&0).and_then(Value::as_uint) != Some(VERSION) {

            return Err(shape("a secret key of an unknown version"));

        }

        let seed = |k: u64| -> Result<[u8; 32], Error> { bytes_of(m.get(&k), "a seed")?.try_into().map_err(|_| shape("a seed")) };

        Ok((key_of(m.get(&1), "the secret's key")?, SecretKey { ed_seed: seed(2)?, ml_seed: seed(3)? }))

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_signature_binds_the_key_and_the_message_and_needs_both_halves() {

        let sk = SecretKey::generate();

        let id = sk.identity("Andy", "a@example", 1);

        let key = id.hash();

        let sig = sk.sign(&key, b"spectra1 test hello");

        verify(&id, &sig, b"spectra1 test hello").unwrap();

        assert_eq!(verify(&id, &sig, b"spectra1 test other"), Err(Error::Ed25519));

        let other = SecretKey::generate().identity("B", "", 1);

        assert_eq!(verify(&other, &sig, b"spectra1 test hello"), Err(Error::KeyMismatch));

        let mut half = sig.clone();

        half.ml[0] ^= 1;

        assert!(verify(&id, &half, b"spectra1 test hello").is_err(), "a broken ML-DSA half fails");

        assert_eq!(Signature::decode(&sig.encode()).unwrap(), sig);

    }

    #[test]

    fn identities_round_trip_and_successors_chain() {

        let sk = SecretKey::generate();

        let id = sk.identity("Andy", "", 5);

        assert_eq!(Identity::decode(&id.encode()).unwrap(), id);

        let agent = SecretKey::generate().identity("claude", "", 5).hash();

        let next = id.successor(vec![Delegate { key: agent, expires: Some(100) }], None, 6);

        assert_eq!(next.previous, Some(id.hash()));

        assert_ne!(next.hash(), id.hash());

        assert!(next.delegates_to(&agent, 99));

        assert!(!next.delegates_to(&agent, 100), "expired");

        assert!(!id.delegates_to(&agent, 1));

        assert!(sk.matches(&next));

        let (k, back) = SecretKey::decode(&sk.encode(&next.hash())).unwrap();

        assert_eq!(k, next.hash());

        assert!(back.matches(&id));

    }

}

- **Changed: Spectra stands alone.** It no longer uses Oxygen in any way: no `oxy` command, no Oxygen library, no Oxygen files. Identities, composite Ed25519 + ML-DSA-65 signatures and deterministic CBOR are Spectra's own. `spectra identity create` makes your identity in `~/.config/spectra` (`SPECTRA_HOME`); `spectra init` delegates to the machine's instance key itself; `spectra agent add` shows the agent and asks before delegating to it (`--yes` for scripts, `--expires 8h` for an overnight agent), `spectra agent renew` gives it more time and `agent disable` takes the delegation back; `spectra connect` shows the server's instance key and asks you to confirm it (`--expect` checks it instead). Ledgers and identity homes made before this change are not readable: run `spectra identity create` and `spectra init` again.

- **Changed: a project is any kind of work.** `spectra project add NAME [--path DIR] [-d TEXT] [--url URL]`, or `spectra project add FOLDER`; Spectra records the folder and reads nothing in it. `spectra project link P --depends-on Q` draws the links `to: downstream` follows, where they used to be read from `.oxymodules`.

- **Fixed: `spectra inbox --follow` could miss a message posted just as it started.** It now subscribes first and reads the inbox once the server says the subscription holds.

 "thiserror",

 "rand",

 "rand",

 "rand_chacha",

 "ed25519-dalek",

 "ml-dsa",

 "rand",

 "thiserror",

 "rand",

 "thiserror",

 "rand",

 "thiserror",

 "rand",

 "thiserror",

 "thiserror",