Post-Quantum Account Hardening

Authorization coverage

Every native transaction is authorized by an ML-DSA-65 signature bound to the account's current control policy. No ECDSA path exists.

Evidence scope

Devnet unit tests and live smokes; public testnet by wallet acceptance from one operator machine.

Evidence

• TestMinervaPQTxRejectsInvalidAuthorization, TestMinervaPQTxCannotUseECDSASigner, TestMinervaPQTxSenderAndCoding (core/types)
• TestMinervaNativeOnlyRuleRejects…, TestMinervaEOATxsDisabledRejects… (core/txpool): legacy transaction types refused at admission
• pnpm pq-native:acceptance; pnpm devnet:pq-native-raw-smoke; wallet acceptance flows against devnet and testnet

Reproduce

• pnpm coregeth:test
• pnpm pq-native:acceptance
• pnpm devnet:start && pnpm devnet:pq-native-raw-smoke

Remaining

• Execution paths mapped: native transfers, self-calls, executeNative and executePQ. Sponsored or relayed account operations are outside this milestone.

Block validation

A block that contains a transaction of another type, or a native transaction that fails the account-control check, is invalid on import, not only refused by the transaction pool.

Evidence scope

The rule lives in the state processor and block validator; its precheck is unit-tested; block-import tests are pending.

Evidence

• minervaNativeOnly fork: enforced in core/minerva.go, the block validator and the state processor; chain-config fork, no node setting
• The same account-control precheck runs at txpool admission, in the state transition and during block processing (TestMinervaRotatedOutKeyIsRejectedOnNativePath exercises the precheck)
• Live devnet and testnet nodes refuse eth_sendRawTransaction for non-native types

Reproduce

• pnpm coregeth:test
• pnpm node:doctor (checks the fork activations against the genesis file)

Remaining

• No dedicated test imports a block carrying an invalid-authorization transaction through InsertChain yet. Until it exists this area stays at IMPLEMENTED.

Control Key rotation

After a rotation takes effect, the previous Control Key is rejected on the native path at every policy version, and the new key controls the same address.

Evidence scope

Devnet unit tests and a live rotation smoke; wallet rotation acceptance on devnet.

Evidence

• TestMinervaRotatedOutKeyIsRejectedOnNativePath: key A refused at policy version 0 and 1 after rotation; key B accepted at version 1; wrong versions refused
• TestMinervaPQTxSkipsCreate2BindingAfterRotation: the address stays bound to the initial key derivation while control moves to the new key
• pnpm devnet:pq-rotation-smoke: live run, key A refused after rotation, key B controls the same address

Reproduce

• pnpm coregeth:test
• pnpm devnet:start && pnpm devnet:pq-rotation-smoke

Remaining

• Verified on single-node devnets and the single-operator testnet; not yet across independently run nodes.

Recovery and permissions

Alternate authorization modules (device keys, recovery) preserve the account policy: a device key cannot rotate or spend outside its scope; recovery ends in a registry write like any rotation.

Evidence scope

Device keys: unit, Foundry and live smoke. Recovery: encrypted Recovery Kit tested; policy-based recovery not built.

Evidence

• TestMinervaDeviceKeyNativePath: device keys admitted only for zero-value self-calls; revoked keys rejected at consensus
• MinervaAccount Foundry scope tests: allowed targets, value window, expiry, protected targets
• pnpm devnet:pq-device-key-smoke; wallet device-key acceptance; pnpm devnet:wallet-pq-backup-smoke (Recovery Kit restores and signs)

Reproduce

• pnpm contracts:test
• pnpm devnet:start && pnpm devnet:pq-device-key-smoke

Remaining

• Guardian or social recovery policies are PLANNED; today recovery means restoring the encrypted ML-DSA key from the Recovery Kit and rotating.

Replay protection

A signature is valid for one account, one network, one operation and one nonce, and under one policy version.

Evidence scope

Unit tests in Go and TypeScript; devnet smokes cover the nonce path.

Evidence

• TestMinervaPQTxRejectsWrongChain: the chain id is part of the signing hash
• TestMinervaPQTxRejectsMismatchedAccountBinding: the account address is bound into the signature
• pq-native-tx tests: policyVersion is part of the signing domain; the EVM account nonce is the only nonce

Reproduce

• pnpm coregeth:test
• pnpm --filter @minerva/pq-native-tx test

ML-DSA integration

The verifier rejects invalid and malformed inputs without reverting, activates by fork block, and agrees with an independent implementation on the same vectors.

Evidence scope

Precompile unit tests; cross-implementation agreement in every smoke (wallet signs with @noble/post-quantum, the node verifies with Cloudflare CIRCL).

Evidence

• TestMinervaMLDSA65PrecompileValidAndInvalid, TestMinervaMLDSA65PrecompileMalformedInputReturnsFalse, TestMinervaPrecompileActivatesByForkBlock (core/vm)
• TestMinervaPQTxMatchesWalletEncoderFixture: one golden vector shared by the Go node and the TypeScript encoder
• TestMinervaTxContextPrecompile: MINERVA_TX_CONTEXT returns the executing transaction's authorization

Reproduce

• pnpm coregeth:test
• pnpm --filter @minerva/pq-native-tx test

Remaining

• Verification gas is a flat 250,000 placeholder; the per-byte model is open.
• FIPS 204 known-answer vectors are not yet wired into the node suite.

Compatibility

Transaction type, precompile addresses, system-contract addresses and EVM rules are fixed, documented and checked by the node's doctor.

Evidence scope

Documented in the protocol docs and the chain configuration; checked by minerva doctor.

Evidence

• Type 0x4D envelope; ML-DSA-65 verify at 0x…4D00, MINERVA_TX_CONTEXT at 0x…4D01; system contracts 0x…0201 to 0x…0205
• Shanghai-level EVM at genesis; blob transactions and EIP-7702 never; every other transaction type invalid
• TestTxTypeSetRepresentsMinervaType…; minerva doctor checks forks, genesis hash and system contracts

Reproduce

• pnpm node:doctor
• minerva-geth genesis-hash <genesis.json>

Remaining

• Compatibility notes for contract tooling (signers, permits, 1271) are documented but not covered by an automated scanner.

Multi-node behaviour

Independently run nodes agree on validity, survive restart and resync, and handle reorganisations without divergent account state.

Evidence scope

Two-node devnet smoke (peering and block sync) only; the public testnet runs one operator node plus its bootnode identity.

Evidence

• scripts/devnet/multinode-smoke.sh: a second node peers with the miner and follows its blocks

Reproduce

• bash scripts/devnet/multinode-smoke.sh

Remaining

• No restart, resync or reorg suite yet; no second operator on the public testnet. MULTI-NODE VERIFIED is not claimed for any area.

Release integrity

Node builds are reproducible and releases carry a classical and a post-quantum signature over the same checksums.

Evidence scope

Two builds of one commit compared byte for byte; signatures verified by the release tooling.

Evidence

• scripts/release/check-reproducible.sh: identical SHA-256 for two builds (commit 73a7404, 2026-10-20, linux/amd64, go1.22.12)
• SSH-signed SHA256SUMS plus an ML-DSA-65 signature (context MINERVA_RELEASE_V1); wallet 0.1.2 published with the same scheme

Reproduce

• bash scripts/release/check-reproducible.sh
• pnpm --filter @minerva/pq-native-tx release:pq verify <pub> SHA256SUMS SHA256SUMS.mldsa65.json

Remaining

• Reproducibility is shown for linux/amd64 only.