grenadeandClaude Opus 5.5
cde186b3fd
ci / gate (push) Successful in 13m28s
NearKey is an ML-DSA-65 key derived from the wallet's phrase as NEP-649 specifies, so the same phrase gives the same NEAR key in any wallet that follows it: SLIP-10 over HMAC-SHA512 keyed "ML-DSA-65 seed", hardened levels only, the node secret as xi for FIPS 204 KeyGen_internal, default path m/44'/397'/0'. The dilithium crate's Keypair::generate is exactly KeyGen_internal; all 22 of NEP-649's published vectors derive to their node secrets and public keys, one of them from the phrase through the wallet's own seed. It signs under the empty context, which is what NEAR verifies; a signature checked under Quantus's context fails, and the test says so. Its handle (SHA3-256 under NEP-645's tag) matches the one mainnet lists for #72's key. near::tx encodes a TransactionV0 as nearcore 2.13 does, hashes it with SHA-256 and signs the hash. Golden bytes pin the encoding. Signing with a key the transaction does not name is refused. Proven once on mainnet outside the test suite: a transaction signed and encoded by this code, from #72's account, was accepted and reported under the hash computed here. No test sends a transaction; nothing in the suite can spend real money. The secrets audit now covers the NEAR key's Debug output too. Refs #74 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NUx7SPonBnB3ofU4mH41WT