Fix signEvent: strip non-NIP-01 statementBytes field from kind 1 template before sending to signer (validateSignerOutput rejects extra fields)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "post_quantum_nostr",
-  "version": "0.0.29",
+  "version": "0.0.30",
   "description": "A migration strategy for bringing post-quantum security to Nostr without breaking the social graph, without requiring consensus on a single post-quantum algorithm, and without forcing existing users to abandon their identities.",
   "main": "index.js",
   "scripts": {

www/js/index-app.mjs

@@ -556,11 +556,25 @@
         setStatus(pqSignStatus, 'info', ' Building kind 1 announcement event...');
         const kind1Template = buildKind1Announcement(currentPubkey, blockHeight, pqKeys);
 
+        // Strip the non-NIP-01 helper field 'statementBytes' before sending to
+        // the signer. buildKind1Announcement includes it for internal use, but
+        // it is not a valid NIP-01 event field and validateSignerOutput (G56-05)
+        // rejects extra fields. The signer must only see the 6 NIP-01 template
+        // fields (pubkey, created_at, kind, tags, content — id/sig are added by
+        // the signer).
+        const kind1SignerTemplate = {
+          pubkey: kind1Template.pubkey,
+          created_at: kind1Template.created_at,
+          kind: kind1Template.kind,
+          tags: kind1Template.tags,
+          content: kind1Template.content
+        };
+
         setStatus(pqSignStatus, 'info', 'PQ signatures complete. Requesting secp256k1 signature for kind 1 announcement...');
 
-        const kind1Signed = await window.nostr.signEvent(kind1Template);
+        const kind1Signed = await window.nostr.signEvent(kind1SignerTemplate);
         // G56-05: validate signer output — never reconstruct from mixed fields
-        kind1Event = validateSignerOutput(kind1Signed, kind1Template, currentPubkey);
+        kind1Event = validateSignerOutput(kind1Signed, kind1SignerTemplate, currentPubkey);
         otsLog(`Kind 1 announcement signed. Event ID: ${kind1Event.id.substring(0, 32)}...`);
 
         // ---- Phase 2: Timestamp the canonical kind 1 event digest (F-D1) ----

www/js/version.json

@@ -1,5 +1,5 @@
 {
-  "VERSION": "v0.0.29",
-  "VERSION_NUMBER": "0.0.29",
-  "BUILD_DATE": "2026-07-25T15:14:52.913Z"
+  "VERSION": "v0.0.30",
+  "VERSION_NUMBER": "0.0.30",
+  "BUILD_DATE": "2026-07-25T17:00:12.091Z"
 }