G56-05: validateSignerOutput() helper — checks all fields, verifies no template field changed, pubkey matches identity, recomputes ID, verifies Schnorr sig, rejects extra fields; replaced reconstruction at all 4 signEvent() call sites; 15 new tests

README.md

@@ -1,5 +1,12 @@
 # Post-Quantum Nostr
 
+> **⚠️ Research prototype.** This project is an experimental pre-quantum key-commitment and
+> identity-link system. It does **not**, by itself, make a Nostr identity post-quantum secure:
+> it links PQ keys to an existing identity and anchors that link in Bitcoin. Complete migration
+> requires companion protocols (PQ event authentication, rotation, encryption, client adoption)
+> that are not yet specified or implemented. Do not enter a valuable existing mnemonic into the
+> web app. See the [implementation status](#implementation-status) section for what exists today.
+
 A migration strategy for bringing post-quantum security to Nostr without breaking the social graph, without requiring consensus on a single post-quantum algorithm, and without forcing existing users to abandon their identities.
 
 ## Table of Contents
@@ -108,7 +115,7 @@ The BIP39 seed is a 64-byte entropy string derived from a mnemonic via PBKDF2-HM
 
 ```mermaid
 flowchart TD
-    SEED[BIP39 Seed - 64 bytes, quantum-safe]
+    SEED[BIP39 Seed - 64 bytes, recovery root]
     SEED --> BIP32[BIP32 derivation - secp256k1 keypair]
     SEED --> PQKEM[BIP32 derivation - ML-KEM keypair]
     SEED --> PQDSA[BIP32 derivation - ML-DSA keypair]
@@ -173,10 +180,13 @@ This is not a separate or weaker construction — it IS BIP32. Using BIP32 paths
 
 | Mnemonic length | Entropy | Post-quantum security (Grover's) | Assessment |
 |---|---|---|---|
-| 12 words | 128 bits | ~64 bits | Borderline |
-| 24 words | 256 bits | ~128 bits | Adequate |
+| 12 words | 128 bits | ~64 bits | Testing only — weaker under a quantum brute-force model |
+| 24 words | 256 bits | ~128 bits | Recommended for a PQ recovery root |
 
-For users concerned about quantum attacks on the seed entropy itself, 24-word mnemonics are recommended. The bigger risk to seed phrases is classical (theft, phishing), not quantum. (Note: the current implementation defaults to 12-word mnemonics; 24-word support is recommended for production use.)
+The implementation defaults to 24-word (256-bit) mnemonics, with a 12-word option available for
+testing. Users concerned about quantum attacks on the seed entropy itself should use 24 words. The
+bigger risk to seed phrases is classical (theft, phishing), not quantum. Note that BIP39's PBKDF2
+iteration count is low; the seed phrase should be treated as a high-value secret and stored offline.
 
 ---
 
@@ -221,18 +231,18 @@ flowchart TD
     SIGN4 --> KIND1
     MLKEM --> KIND1
 
-    SECP --> ACCT1[Account 1 - existing identity signs kind 1 and kind 11112]
+    SECP --> ACCT1[Account 1 - existing identity signs kind 1 and kind 9999]
 
     KIND1 --> OTS[OpenTimestamp the kind 1 event hash]
-    OTS --> KIND11112[Kind 11112 Wrapper Event - carries OTS proof]
-    KIND11112 --> RELAY[Published to relays NOW]
+    OTS --> KIND9999[Kind 9999 Proof Carrier - carries OTS proof]
+    KIND9999 --> RELAY[Published to relays NOW]
 
     RELAY --> CLIENT1[PQ-aware client - picks ML-DSA]
     RELAY --> CLIENT2[PQ-aware client - picks SLH-DSA]
     RELAY --> CLIENT3[Legacy client - ignores all PQ keys]
 
     style KIND1 fill:#ffa
-    style KIND11112 fill:#ffa
+    style KIND9999 fill:#ffa
     style OTS fill:#cfc
 ```
 
@@ -275,9 +285,9 @@ pending timestamp on the Bitcoin blockchain via OpenTimestamps.
 
 Each PQ signature scheme signs `TextEncoder.encode(content)` — the human-readable attestation text. The event is signed with the user's **existing** Nostr identity (Account #1) via `window.nostr.signEvent` (NIP-07).
 
-#### 2. Kind 11112 Wrapper (machine-verifiable, carries the OTS proof)
+#### 2. Kind 9999 Proof Carrier (machine-verifiable, carries the OTS proof)
 
-A replaceable event (kind 11112, in the 10000–19999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. The content is the full kind 1 event as JSON (so verifiers don't need to fetch it from relays).
+A non-replaceable event (kind 9999, in the 0–9999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. The content is the full kind 1 event as JSON (so verifiers don't need to fetch it from relays). Each publication is permanent — upgrades publish a new event with an `upgrade_of` tag referencing the previous one.
 
 **Content:** `JSON.stringify(kind1Event)` — the full signed kind 1 event embedded as a JSON string.
 
@@ -292,7 +302,7 @@ The wrapper is signed with the user's existing identity (Account #1) via `window
 
 **What the event proves:**
 - Each PQ signature scheme (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512) signed the attestation text — verified by checking each PQ signature against the pubkey in its tag.
-- The user's existing Nostr identity (Account #1) authorized the migration — verified by the secp256k1 Schnorr signature on the kind 1 and kind 11112 events.
+- The user's existing Nostr identity (Account #1) authorized the migration — verified by the secp256k1 Schnorr signature on the kind 1 and kind 9999 events.
 - The event is anchored to a pre-quantum Bitcoin block via OpenTimestamps — the event with the earliest valid OTS proof wins (see Component 3).
 
 **What the event does NOT prove:**
@@ -334,7 +344,7 @@ If a specific PQ scheme is later found to be weak (like SIKE was):
 
 ## Component 3: OpenTimestamps for Pre-Quantum Anchoring
 
-NIP-03 (OpenTimestamps Attestations for Events) anchors Nostr event hashes to the Bitcoin blockchain via OpenTimestamps. The implementation submits the **SHA-256 of the full signed kind 1 event JSON** (including its `id` and `sig`) to the OpenTimestamps calendar servers, and embeds the resulting `.ots` proof in the kind 11112 wrapper's `ots` tag.
+NIP-03 (OpenTimestamps Attestations for Events) anchors Nostr event hashes to the Bitcoin blockchain via OpenTimestamps. The implementation submits the **SHA-256 of the full signed kind 1 event JSON** (including its `id` and `sig`) to the OpenTimestamps calendar servers, and embeds the resulting `.ots` proof in the kind 9999 proof carrier's `ots` tag.
 
 ### Why Bitcoin Timestamping Is Quantum-Resistant
 
@@ -364,14 +374,35 @@ The kind 1 announcement event MUST be timestamped via OpenTimestamps. This preve
 
 The implementation timestamps the **SHA-256 of the full signed kind 1 event JSON** (computed by hashing `JSON.stringify(kind1Event)`, which includes the `id` and `sig` fields). This hash is:
 1. Submitted to OpenTimestamps calendar servers to obtain a pending `.ots` proof.
-2. Recorded in the kind 11112 wrapper's `sha256` tag.
-3. The `.ots` proof is embedded in the kind 11112 wrapper's `ots` tag.
+2. Recorded in the kind 9999 proof carrier's `sha256` tag.
+3. The `.ots` proof is embedded in the kind 9999 proof carrier's `ots` tag.
 
-The kind 11112 wrapper *carries* the OTS proof; the kind 1 event *is* what's timestamped. Verifiers re-compute the hash from the embedded kind 1 event and check it matches the `sha256` tag.
+The kind 9999 proof carrier *carries* the OTS proof; the kind 1 event *is* what's timestamped. Verifiers re-compute the hash from the embedded kind 1 event and check it matches the `sha256` tag.
 
 ### Current OTS Verification Status
 
-The current implementation detects Bitcoin confirmation by searching the `.ots` proof bytes for the Bitcoin block-header attestation magic bytes, and delegates proof upgrading to a server-side helper. **Full client-side OTS verification** (parsing the proof, validating the Merkle path, checking the block header against the Bitcoin chain) is planned but not yet implemented. The vendored `javascript-opentimestamps` library in `resources/` provides the necessary primitives and will be integrated in a future release.
+> **Research prototype — trust model.** The current OTS verification is **API-assisted**, not a
+> full Bitcoin light-client verification. Treat results accordingly.
+
+The current implementation:
+
+- Parses the `.ots` proof and validates the Merkle path against a block header obtained from a
+  public Bitcoin explorer API (mempool.space).
+- Detects Bitcoin confirmation by searching the proof bytes for the block-header attestation magic
+  bytes and confirming the attested block height via the same API.
+- Delegates proof *upgrading* (asking calendars for a confirmed proof) to a server-side helper.
+
+**What is NOT done:**
+
+- **Full light-client verification** — validating the block header's proof-of-work, difficulty, and
+  chain linkage independently, without trusting an explorer API. The vendored
+  `javascript-opentimestamps` library in `resources/` provides primitives for this and will be
+  integrated in a future release.
+- **Multi-explorer cross-checking** — comparing independent APIs and rejecting disagreement.
+
+Because the block header is trusted from a single API, a compromised or malicious explorer could
+falsify a confirmation. The UI labels this as "API-checked," not "cryptographically verified on
+Bitcoin."
 
 ### What Should Be OpenTimestamped
 
@@ -646,8 +677,8 @@ flowchart TD
         KIND1 --> SECP1[Account 1 signs kind 1 via signer]
         SECP1 --> HASH[SHA-256 of full signed kind 1 event JSON]
         HASH --> OTS[Submit hash to OpenTimestamps]
-        OTS --> KIND11112[Build kind 11112 wrapper with OTS proof]
-        KIND11112 --> SECP2[Account 1 signs kind 11112 via signer]
+        OTS --> KIND9999[Build kind 9999 proof carrier with OTS proof]
+        KIND9999 --> SECP2[Account 1 signs kind 9999 via signer]
         SECP2 --> RELAY[Publish both events to relays]
         SEED --> BACKUP[User writes down 12-word phrase]
     end
@@ -655,7 +686,7 @@ flowchart TD
     subgraph CONFIRM["Bitcoin confirmation"]
         POLL[Poll OTS upgrade service]
         POLL --> UPGRADE[Upgrade .ots proof with Bitcoin attestation]
-        UPGRADE --> REPUBLISH[Republish kind 11112 with confirmed proof]
+        UPGRADE --> REPUBLISH[Publish new kind 9999 with confirmed proof]
     end
 
     subgraph FUTURE["Post-quantum - when quantum computers arrive"]
@@ -682,10 +713,10 @@ flowchart TD
 2. Client generates a 12-word phrase, shows it to the user to write down
 3. Client derives 5 PQ keypairs from the seed via BIP32 paths
 4. Each PQ signature scheme signs the human-readable attestation text
-5. The user's signer signs the kind 1 announcement and the kind 11112 wrapper
+5. The user's signer signs the kind 1 announcement and the kind 9999 proof carrier
 6. The SHA-256 of the full signed kind 1 event is submitted to OpenTimestamps
 7. Both events are published to relays
-8. The client polls for Bitcoin confirmation and republishes the kind 11112 wrapper with the confirmed OTS proof
+8. The client polls for Bitcoin confirmation and publishes a new kind 9999 proof carrier with the confirmed OTS proof (append-only — the original remains on relays)
 9. After quantum migration: clients use PQ keys, old key retired
 
 ---
@@ -747,7 +778,7 @@ The current implementation is a static web app (`www/`) that performs the full m
 | PQ signing (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512) | Implemented | `www/js/pq-crypto.mjs` |
 | ML-KEM-768 keygen (KEM, no signing) | Implemented | `www/js/pq-crypto.mjs` |
 | Kind 1 announcement event construction | Implemented | `www/js/pq-crypto.mjs` |
-| Kind 11112 wrapper event construction | Implemented | `www/js/pq-crypto.mjs` |
+| Kind 9999 proof carrier event construction | Implemented | `www/js/pq-crypto.mjs` |
 | NIP-01 event ID computation and Schnorr verification | Implemented | `www/js/pq-crypto.mjs` |
 | OpenTimestamps submission (pending proof) | Implemented | `www/js/pq-crypto.mjs` |
 | OTS upgrade polling (via server helper) | Implemented | `www/js/pq-crypto.mjs` |
@@ -759,12 +790,12 @@ The current implementation is a static web app (`www/`) that performs the full m
 
 | Component | Description |
 |---|---|
-| Full client-side OTS verification | Parse the .ots proof, validate the Merkle path, check the block header against the Bitcoin chain (the vendored `javascript-opentimestamps` library in `resources/` provides the primitives) |
-| OTS target-digest binding | Verify the OTS proof's target digest equals the event's `sha256` tag |
+| Full light-client Bitcoin verification | Validate block headers, proof-of-work, difficulty, and chain linkage independently of an explorer API (the vendored `javascript-opentimestamps` library in `resources/` provides primitives). Current path trusts a single explorer API for the header. |
+| Multi-explorer cross-checking | Compare independent Bitcoin APIs and reject disagreement |
 | Raw-nsec migration (Component 4) | Encrypt old nsec, publish kind 30078, 36-word phrase encoding |
 | Quantum-safe self-storage (Component 5) | OTP or symmetric-key encryption for kind 30078 data |
-| Test suite | Known-answer tests for derivation, PQ sign/verify round-trips, event verification |
-| 24-word mnemonic default | Currently defaults to 12 words; 24 recommended for production |
+| PQ event authentication / rotation / revocation | Companion protocols for signing future events with PQ keys, rotating/revoking keys, PQ encryption |
+| Independent implementation / test vectors | A second implementation reproducing canonical encoding, derivation, and selection |
 
 ### Dependencies
 
@@ -775,7 +806,7 @@ The current implementation is a static web app (`www/`) that performs the full m
 - [`@scure/bip32`](https://github.com/paulmillr/scure-bip32) — BIP32 HD wallet derivation
 - [`@scure/base`](https://github.com/paulmillr/scure-base) — bech32 (npub) encoding
 - [OpenTimestamps](https://opentimestamps.org/) — calendar servers for timestamping
-- [`javascript-opentimestamps`](resources/javascript-opentimestamps/) — vendored OTS library (present, not yet integrated for client-side verification)
+- [`javascript-opentimestamps`](resources/javascript-opentimestamps/) — vendored OTS library (used as a fixture source; full light-client integration pending)
 - [nostr-login-lite](https://github.com/nostrband/nostr-login-lite) — NIP-07 / NIP-46 authentication
 
 ---

audits/GPT5.6/remediation_progress.md

@@ -0,0 +1,127 @@
+# GPT-5.6 Audit Remediation Progress
+
+**Audit:** [`audits/GPT5.6/audit.md`](audit.md:1)  
+**Mitigation plan:** [`audits/GPT5.6/audit_mitigation.md`](audit_mitigation.md:1)  
+**Last updated:** 2026-07-24
+
+## Summary
+
+| Severity | Total | Fixed | In Progress | Not Started |
+|---|---:|---:|---:|---:|
+| Critical | 2 | 2 | 0 | 0 |
+| High | 6 | 3 | 0 | 3 |
+| Medium | 8 | 2 | 0 | 6 |
+| Low / Info | 4 | 0 | 0 | 4 |
+| **Total** | **20** | **7** | **0** | **13** |
+
+## Findings status
+
+| ID | Severity | Finding | Status | Version | Notes |
+|---|---|---|---|---|---|
+| G56-01 | Critical | Verifier accepts no PQ signatures and missing signatures as successful | ✅ Fixed | v0.0.12 | Strict mandatory algorithm policy, fail-closed on malformed input, structured result fields, 11 adversarial tests |
+| G56-02 | Critical | Earliest-valid-anchor rule not implemented; relay discovery selects latest replaceable event | ✅ Fixed | v0.0.14–v0.0.16 | Switched to non-replaceable kind 9999, append-only upgrades with `upgrade_of` tag, `selectCanonicalProofCarrier()` function, removed `limit: 1` from relay queries, updated all docs |
+| G56-03 | High | Outer wrapper identity not bound to embedded identity | ✅ Fixed | v0.0.14 | Added `outerPubkey` and `expectedAuthor` options to `verifyNIPQRContent()`, `identityBound` field in result, `validForMigration` requires identity binding, 4 identity binding tests |
+| G56-04 | High | Bitcoin verification trusts public API JSON, doesn't validate headers/PoW | ❌ Not started | — | Needs trust-mode labeling or real header validation |
+| G56-05 | High | Signer output reconstructed without validating returned ID/sig/pubkey/fields | ✅ Fixed | v0.0.20 | Added `validateSignerOutput()` helper: checks all required fields present + typed, verifies no template field (content/tags/created_at/kind) changed, verifies pubkey equals expected identity, recomputes + verifies event ID, verifies Schnorr signature, rejects extra fields. Replaced reconstruction at all 4 `signEvent()` call sites (2 in index.html, 2 in verify.html) with validation + retain-exact-signed-object. 15 new tests (mutated content/tags/kind/created_at, wrong pubkey, wrong ID, invalid sig, extra field, missing field, non-object, malformed id/sig, tag element changed) |
+| G56-06 | High | New seed continuity asserted, not proven — no successor signature, no identity match | ❌ Not started | — | Protocol design decision needed |
+| G56-07 | High | Verifier throws on malformed relay/paste input | ✅ Fixed | v0.0.12, v0.0.19 | v0.0.12 wrapped base64/hex in try/catch + verifyNIPQRContent fail closed + verify.html call-site wrapping. v0.0.19 added structural validation + try/catch to `verifyNostrEvent()` (returns false on malformed input), wrapped `parseOtsFile()` body in try/catch (returns null), added `MAX_OTS_PROOF_SIZE` (1 MiB) and `MAX_EVENT_JSON_SIZE` (64 KiB) size guards, 23 fuzz/property tests (random JSON, random bytes, truncation, oversized inputs, wrong-typed objects) |
+| G56-08 | High | Browser origin security insufficient for seed handling | ❌ Not started | — | Needs CSP hardening, header fixes, asset pinning |
+| G56-09 | Medium | 12-word seed default, warning removed | ✅ Fixed | v0.0.17 | Defaulted `generateSeedPhrase()` and `generateSeedPhraseWithEntropy()` to 24 words (256-bit); added 12/24-word selector UI; restored entropy-strength warning; removed "quantum-safe root of trust" / "Make your Nostr identity quantum-resistant" claims from index.html, README.md, nip_proposal.md; 4 new tests |
+| G56-10 | Medium | Secret material not zeroized, retained in globals/DOM/clipboard | ❌ Not started | — | Minimize secret lifetime, overwrite typed arrays |
+| G56-11 | Medium | Publication advances despite zero relay acceptance | ❌ Not started | — | Require relay OK for both events |
+| G56-12 | Medium | Resume workflow insufficiently bound to original event | ⚠️ Partially fixed | v0.0.14 | Resume now fetches all candidates and matches by event ID. Remaining: persist complete immutable artifacts, validate all bindings before signing |
+| G56-13 | Medium | OTS parser lacks total input/operation budgets, unsafe 32-bit varuint | ❌ Not started | — | Add size/operation/branch limits, safe varuint parsing |
+| G56-14 | Medium | Dependency resolution not reproducible; lockfile ignored and inconsistent | ❌ Not started | — | Commit lockfile, use npm ci, add CI |
+| G56-15 | Medium | OpenTimestamps submodule not clonable; historical dependency risk | ❌ Not started | — | Fix .gitmodules or vendor immutable snapshot |
+| G56-16 | Medium | Documentation and UI overclaim implementation status | ✅ Fixed | v0.0.14–v0.0.18 | Kind 9999 docs (v0.0.14–v0.0.16); v0.0.17 fixed index.html claims + 24-word default; v0.0.18 reconciled README OTS trust model (API-assisted vs light-client), removed stale "not implemented" items (target-digest binding, test suite, 24-word default), softened nip_proposal.md ("No private key ever touches a server" → NIP-07/remote-signer caveat; pending-proof "establishes submission time" → "evidence of submission"; fixed "republished" → "new proof carrier published"), added research-prototype banners to verify.html + README + nip_proposal + explanation.md + laans_explanation.md + why_what_how.md + all 5 research/ docs |
+| G56-17 | Low | Block-height statement not validated | ❌ Not started | — | Validate against OTS height or remove from signed content |
+| G56-18 | Low | Relay URL policy permits insecure ws:// | ❌ Not started | — | Require wss:// in production |
+| G56-19 | Low | Missing event IDs accepted by library verifier | ❌ Not started | — | Require exact NIP-01 shape with 64-hex ID |
+| G56-20 | Info | Large events may be rejected by relays; interoperability untested | ❌ Not started | — | Test against target relay policies |
+
+## Changes by version
+
+### v0.0.12 — G56-01 fix
+- Rewrote `verifyNIPQRContent()` with strict mandatory algorithm policy
+- Missing signatures on signature algorithms now fail (not treated as KEM successes)
+- Unknown algorithms reported as ignored, not valid evidence
+- Duplicate algorithm detection
+- Public key length validation
+- All base64/verification wrapped in try/catch (fail closed)
+- Added `pqProofsValid`, `policySufficient`, `validForMigration`, `errors` fields to result
+- Updated `verify.html` to display "PQ algorithm policy" result line
+- Added 11 adversarial tests
+
+### v0.0.13 — Checkbox UI fix
+- Fixed checkbox fill (background red when checked, not just border)
+
+### v0.0.14 — G56-02 + G56-03 fix
+- Changed `NIP_QR_KIND` from 11112 (replaceable) to 9999 (non-replaceable)
+- Added `buildProofCarrier()` with `ots_status` and `upgrade_of` tags
+- `buildUpgradedEvent()` now creates append-only events (not replacements)
+- Added `selectCanonicalProofCarrier()` for earliest-valid-anchor selection
+- Removed `limit: 1` from relay queries in verify.html and index.html
+- Added identity binding (`outerPubkey`, `expectedAuthor`) to `verifyNIPQRContent()`
+- Added `identityBound` field to verification result
+- Updated resume workflow to fetch all candidates
+- Added 12 new tests (8 for G56-02, 4 for G56-03)
+
+### v0.0.15 — Documentation update
+- Updated nip_proposal.md and README.md for kind 9999
+
+### v0.0.16 — Eliminate old references
+- Eliminated all remaining "kind 11112" references from user-facing files and docs
+- Updated explanation.md, laans_explanation.md, why_what_how.md
+- Cleaned up button IDs and import statements in index.html
+
+### v0.0.17 — G56-09 fix
+- `generateSeedPhrase()` and `generateSeedPhraseWithEntropy()` now default to 24 words (256-bit entropy)
+- Both accept an `entropyBits` argument (128 or 256) and validate it
+- Added 12/24-word radio selector to the seed-generation panel in `index.html`; toggling regenerates the seed
+- Restored entropy-strength warning (12 words = ~64-bit under Grover, testing only; 24 words recommended)
+- Removed inaccurate claims: "Make your Nostr identity quantum-resistant" → "Create an experimental pre-quantum PQ key commitment"; "quantum-safe root of trust" → "recovery root"; "quantum-safe seed phrase" → "seed phrase"
+- Added research-prototype warning to the unauthenticated landing card
+- Updated README.md entropy table and nip_proposal.md mermaid diagram
+- Added 4 new tests (24-word default, 12-word option, invalid entropyBits rejection for both functions)
+
+### v0.0.18 — G56-16 fix (status reconciliation)
+- README.md: rewrote OTS verification status section to distinguish API-assisted verification (current, trusts explorer) from full light-client verification (not implemented); added research-prototype banner
+- README.md: removed stale "not implemented" items (OTS target-digest binding, test suite, 24-word default); added accurate not-implemented items (light-client verification, multi-explorer cross-check, PQ event auth/rotation, independent implementation)
+- nip_proposal.md: softened "No private key ever touches a server" → NIP-07/remote-signer caveat + API-assisted OTS trust model; pending-proof "establishes submission time" → "evidence of submission, not an independent timestamp"; fixed "republished" → "new proof carrier published with upgrade_of tag"
+- verify.html: added research-prototype note; rewrote card description to list each verification check as a separate result line (PQ signatures individually, policy sufficiency, identity binding)
+- Added research-prototype / design-only banners to explanation.md, laans_explanation.md, why_what_how.md, and all 5 research/ docs
+- No new tests (documentation-only change)
+
+### v0.0.19 — G56-07 fix (fuzz testing + fail-closed verifiers)
+- `verifyNostrEvent()`: added structural validation (type-checks all required fields) + try/catch; returns `false` on any malformed input instead of throwing
+- `parseOtsFile()`: wrapped parser body in try/catch; returns `null` on any malformed/truncated input
+- Added `MAX_OTS_PROOF_SIZE` (1 MiB) and `MAX_EVENT_JSON_SIZE` (64 KiB) size guards; oversized inputs rejected before any parsing/decoding work
+- `verifyNIPQRContent()`: added content-size guard at entry
+- verify.html relay path already had try/catch (G56-01); now defense-in-depth with internal fail-closed
+- 23 new fuzz/property tests: random JSON shapes to `verifyNIPQRContent` (1000 iterations), random bytes to `parseOtsFile` (2000 iterations), random objects to `verifyNostrEvent` (500 iterations), truncated valid-prefix bytes, oversized inputs, wrong-typed objects, `isOtsConfirmed` fuzz
+
+### v0.0.20 — G56-05 fix (signer output validation)
+- Added `validateSignerOutput(signedEvent, template, expectedPubkey)` helper in `pq-crypto.mjs`:
+  - Checks all 7 required NIP-01 fields present + correctly typed
+  - Verifies id (64 hex), pubkey (64 hex), sig (128 hex) format
+  - Verifies no template field changed (content, tags deep-compare, created_at, kind)
+  - Verifies returned pubkey equals expected identity
+  - Recomputes event ID and verifies match
+  - Verifies Schnorr signature
+  - Rejects extra unexpected fields
+  - Returns the validated signed object (not a reconstruction)
+- Replaced reconstruction at all 4 `signEvent()` call sites:
+  - `index.html`: kind 1 announcement (was mixing template + signer fields), proof carrier (same), upgrade (now validated)
+  - `verify.html`: upgrade (now validated)
+- 15 new tests: valid output, mutated content/tags/kind/created_at, wrong pubkey, wrong ID, invalid sig, extra field, missing field, non-object, malformed id/sig, tag element changed, no-expectedPubkey backward compat
+
+## Test count
+
+- **Before remediation:** 38 tests
+- **After G56-01:** 49 tests
+- **After G56-02+03:** 61 tests
+- **After G56-09:** 65 tests
+- **After G56-16:** 65 tests (docs-only)
+- **After G56-07:** 88 tests
+- **After G56-05:** 103 tests
+- **All passing:** ✅

explanation.md

@@ -1,5 +1,10 @@
 # How the NIP-QR Event Is Constructed: Step by Step
 
+> **⚠️ Research prototype.** This document describes an experimental pre-quantum key-commitment
+> system. It links PQ keys to an existing Nostr identity and anchors that link in Bitcoin; it does
+> not, by itself, make the identity post-quantum secure. Complete migration requires companion
+> protocols not yet specified or implemented.
+
 ## The Misconception
 
 The seed phrase is NOT used directly as the private key for PQ signing. The seed phrase is a source of entropy that is used to **derive** separate keys for each PQ algorithm via **BIP32 HD wallet derivation paths** — the same standard used by NIP-06 for secp256k1 keys.
@@ -175,13 +180,13 @@ full_hash → OpenTimestamps calendar → pending .ots proof
 
 This hash is what gets anchored to the Bitcoin blockchain.
 
-## Step 11: Build and sign the kind 11112 wrapper event
+## Step 11: Build and sign the kind 9999 proof carrier event
 
-A kind 11112 wrapper event is built that embeds the full kind 1 event as JSON content and carries the OTS proof:
+A kind 9999 proof carrier event is built that embeds the full kind 1 event as JSON content and carries the OTS proof:
 
 ```json
 {
-  "kind": 11112,
+  "kind": 9999,
   "pubkey": "<Account #1 secp256k1 pubkey (hex)>",
   "created_at": 1720780000,
   "content": "<JSON string of the full signed kind 1 event>",
@@ -197,7 +202,7 @@ This wrapper is sent to the user's signer (`window.nostr.signEvent()`), which si
 
 ## Step 12: Publish both events
 
-Both the kind 1 announcement and the kind 11112 wrapper are published to Nostr relays. The client then polls the OpenTimestamps upgrade service for Bitcoin confirmation and republishes the kind 11112 wrapper with the confirmed OTS proof once the Bitcoin attestation is received.
+Both the kind 1 announcement and the kind 9999 proof carrier are published to Nostr relays. The client then polls the OpenTimestamps upgrade service for Bitcoin confirmation and republishes the kind 9999 proof carrier with the confirmed OTS proof once the Bitcoin attestation is received.
 
 ---
 
@@ -210,7 +215,7 @@ Both the kind 1 announcement and the kind 11112 wrapper are published to Nostr r
 | SLH-DSA-128s private key | The attestation text (content) | PQ signature (hash-based, Cat 1) | Conservative fallback if lattice schemes break |
 | Falcon-512 private key | The attestation text (content) | PQ signature (lattice, Cat 1) | Compact signatures, compatible with trbouma's PR |
 | Account #1 secp256k1 key | The kind 1 announcement event | Schnorr signature | Existing identity authorizes the migration |
-| Account #1 secp256k1 key | The kind 11112 wrapper event | Schnorr signature | Existing identity authorizes the wrapper + OTS proof |
+| Account #1 secp256k1 key | The kind 9999 proof carrier event | Schnorr signature | Existing identity authorizes the wrapper + OTS proof |
 | ML-KEM-768 | (nothing — KEM, not signature) | N/A | Ownership asserted by attestation text; authorized by Account #1's signature covering the tags |
 
 ## Summary: BIP32 Key Derivation Tree

laans_explanation.md

@@ -1,8 +1,11 @@
 # Laan's explanation
 
+> **⚠️ Research prototype.** This is a short summary of an experimental pre-quantum key-commitment
+> system. It does not, by itself, make a Nostr identity post-quantum secure.
+
 A short summary of how the post-quantum Nostr migration works, matching the implementation.
 
-1. **Create a new seed phrase.** This is your post-quantum (PQ) Nostr backup. It's a 12-word BIP39 mnemonic — pure entropy, not tied to any algorithm.
+1. **Create a new seed phrase.** This is your post-quantum (PQ) Nostr backup. It's a BIP39 mnemonic (24 words by default; 12 words available for testing) — pure entropy, not tied to any algorithm.
 
 2. **Derive 5 PQ keypairs from the seed.** Using BIP32 hierarchical deterministic derivation (the same standard as NIP-06), each PQ algorithm gets its own child key under the path `m/44'/1237'/0'/0/`:
    - child 1 → ML-DSA-44
@@ -17,10 +20,10 @@ A short summary of how the post-quantum Nostr migration works, matching the impl
 
 4. **Each PQ key signs the attestation.** Each PQ signature scheme (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512) signs the attestation text. ML-KEM-768 does NOT sign — it's a KEM (Key Encapsulation Mechanism), not a signature scheme. Its public key is included in a tag without a signature.
 
-5. **Your existing identity signs the events.** The kind 1 announcement (with PQ signatures in its tags) and a kind 11112 wrapper (which embeds the kind 1 event as JSON and carries the OpenTimestamps proof) are both signed by your **existing** Nostr identity via `window.nostr.signEvent()`. This authorizes the migration.
+5. **Your existing identity signs the events.** The kind 1 announcement (with PQ signatures in its tags) and a kind 9999 proof carrier (which embeds the kind 1 event as JSON and carries the OpenTimestamps proof) are both signed by your **existing** Nostr identity via `window.nostr.signEvent()`. This authorizes the migration.
 
 6. **Timestamp the kind 1 event.** The SHA-256 of the full signed kind 1 event JSON is submitted to OpenTimestamps, anchoring it to the Bitcoin blockchain. This proves the event existed at this point in time, pre-quantum.
 
-7. **Publish both events to relays.** The kind 1 announcement and the kind 11112 wrapper are published. The client then polls for Bitcoin confirmation and republishes the kind 11112 wrapper with the confirmed OTS proof.
+7. **Publish both events to relays.** The kind 1 announcement and the kind 9999 proof carrier are published. The client then polls for Bitcoin confirmation and republishes the kind 9999 proof carrier with the confirmed OTS proof.
 
 **Note:** The seed-derived secp256k1 key (at `m/44'/1237'/0'/0/0`) is derived but not used to sign. There is no "successor signature." The security model relies on OTS precedence — the real event is anchored pre-quantum, and a forged event cannot be backdated to before that anchor.

nip_proposal.md

@@ -35,19 +35,19 @@ The PQ standardization landscape is still young. SIKE was a NIST finalist broken
 A user with an existing Nostr identity (the **attesting identity**) publishes two events:
 
 1. A **kind 1 announcement** — a human-readable attestation whose `content` is signed by each PQ signature scheme, with the PQ public keys and signatures carried in `algorithm` tags.
-2. A **kind 11112 wrapper** — a replaceable event that embeds the full signed kind 1 event as JSON content and carries an OpenTimestamps proof anchoring the kind 1 event to a Bitcoin block.
+2. A **kind 9999 proof carrier** — a non-replaceable event that embeds the full signed kind 1 event as JSON content and carries an OpenTimestamps proof anchoring the kind 1 event to a Bitcoin block. Upgrades (pending → confirmed) publish a new kind 9999 event with an `upgrade_of` tag referencing the previous one; both remain on relays permanently.
 
 The PQ keys are derived deterministically from a BIP39 seed phrase via BIP32, at fixed child indices under the NIP-06 base path. This means a user who has backed up their seed phrase can always recover the same PQ keys, on any conforming implementation.
 
 ```mermaid
 flowchart TD
-    SEED[BIP39 seed - quantum-safe root of trust] --> SECP[secp256k1 keypair - child 0]
+    SEED[BIP39 seed - recovery root] --> SECP[secp256k1 keypair - child 0]
     SEED --> PQ[PQ keypairs - children 1..8]
     SECP --> K1[Kind 1 announcement - attesting identity signs]
     PQ --> K1
     K1 --> OTS[OpenTimestamps anchor to Bitcoin block]
-    OTS --> K11112[Kind 11112 wrapper - carries OTS proof]
-    K11112 --> RELAY[Published to relays]
+    OTS --> K9999[Kind 9999 proof carrier - carries OTS proof]
+    K9999 --> RELAY[Published to relays]
 ```
 
 ## PQ key derivation from a BIP39 seed
@@ -157,9 +157,11 @@ Future NIPs may register additional `algorithm-id` values and additional BIP32 c
 }
 ```
 
-## The kind 11112 wrapper event
+## The kind 9999 proof carrier event
 
-A **replaceable** event (kind 11112, in the 10000–19999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. It is signed with the attesting identity's secp256k1 key.
+A **non-replaceable** event (kind 9999, in the 0–9999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. It is signed with the attesting identity's secp256k1 key.
+
+Kind 9999 is non-replaceable: each publication is permanent on relays. Upgrades (e.g. pending → confirmed OTS proof) publish a **new** kind 9999 event with an `upgrade_of` tag referencing the previous one. Both events remain on relays. Clients fetch all kind 9999 events for a pubkey and select the one with the earliest valid Bitcoin anchor.
 
 The kind number is provisional and subject to maintainer allocation.
 
@@ -177,7 +179,7 @@ The kind number is provisional and subject to maintainer allocation.
 
 ```json
 {
-  "kind": 11112,
+  "kind": 9999,
   "pubkey": "<attesting identity secp256k1 pubkey, hex>",
   "content": "<JSON string of the full signed kind 1 event>",
   "tags": [
@@ -203,11 +205,11 @@ With an OTS anchor, the real event is committed to a specific Bitcoin block befo
 
 ### Verification rule: earliest valid anchor wins
 
-When a client finds multiple kind 11112 wrappers for the same attesting identity, it verifies the OTS proof in each and selects the one whose Bitcoin attestation has the **earliest block height**. That wrapper's embedded kind 1 event is the canonical key-link for that identity. Later wrappers, even if validly signed, are treated as superseding only if they are signed by a PQ key already linked by the earliest wrapper.
+When a client finds multiple kind 9999 proof carriers for the same attesting identity, it verifies the OTS proof in each and selects the one whose Bitcoin attestation has the **earliest block height**. That proof carrier's embedded kind 1 event is the canonical key-link for that identity. Later proof carriers, even if validly signed, are treated as superseding only if they are signed by a PQ key already linked by the earliest proof carrier.
 
 ### OTS proof states
 
-An OTS proof may be **pending** (not yet anchored in a Bitcoin block) or **confirmed** (anchored). A pending proof asserts that the digest has been submitted to calendar servers; a confirmed proof asserts a Bitcoin block commitment. Clients SHOULD treat a confirmed proof as authoritative. A pending proof is still useful: it establishes that the digest existed at submission time, and it can be upgraded to a confirmed proof later by re-querying the calendars. The wrapper is republished with the upgraded proof.
+An OTS proof may be **pending** (not yet anchored in a Bitcoin block) or **confirmed** (anchored). A pending proof is evidence that the digest was submitted to calendar servers; it is **not** an independent timestamp and depends on calendar behavior. A confirmed proof asserts a Bitcoin block commitment. Clients SHOULD treat a confirmed proof as authoritative. A pending proof can be upgraded to a confirmed proof later by re-querying the calendars; when that happens, a **new** proof carrier event is published carrying the upgraded proof and referencing the original via an `upgrade_of` tag. The original event remains on relays permanently.
 
 ### Client-side verification
 
@@ -217,10 +219,11 @@ Clients SHOULD perform full client-side OTS verification: parse the proof, walk
 
 ### PQ-aware clients
 
-A PQ-aware client, when it encounters a kind 11112 wrapper for a pubkey it cares about:
+A PQ-aware client, when it encounters a kind 9999 proof carrier for a pubkey it cares about:
 
-1. Parses the embedded kind 1 event from the wrapper's `content`.
-2. Verifies the attesting identity's secp256k1 signature on both the kind 1 and the kind 11112 events.
+1. Parses the embedded kind 1 event from the proof carrier's `content`.
+2. Verifies the attesting identity's secp256k1 signature on both the kind 1 and the kind 9999 events.
+3. Verifies that the proof carrier's pubkey matches the embedded kind 1 event's pubkey (identity binding).
 3. Verifies the `sha256` tag matches `sha256(JSON.stringify(kind1Event))`.
 4. For each `algorithm` tag with a signature, verifies the PQ signature against the pubkey in the tag, over `TextEncoder.encode(kind1Event.content)`.
 5. Verifies the OTS proof in the `ots` tag against the `sha256` digest.
@@ -231,14 +234,14 @@ After a quantum break of secp256k1, the client trusts the PQ keys from the earli
 
 ### Legacy clients
 
-Legacy clients see the kind 1 announcement as an ordinary text note and the kind 11112 wrapper as an unknown replaceable event. They ignore both. Nothing breaks.
+Legacy clients see the kind 1 announcement as an ordinary text note and the kind 9999 proof carrier as an unknown event. They ignore both. Nothing breaks.
 
 ## What this NIP proves and does not prove
 
 **It proves:**
 
 - Each PQ signature scheme listed in the tags signed the attestation text. Verified by checking each PQ signature against its tag's pubkey.
-- The attesting identity authorized the link. Verified by the secp256k1 Schnorr signature on the kind 1 and kind 11112 events, valid pre-quantum.
+- The attesting identity authorized the link. Verified by the secp256k1 Schnorr signature on the kind 1 and kind 9999 events, valid pre-quantum.
 - The link existed at a specific pre-quantum Bitcoin block. Verified by the OTS proof.
 
 **It does not prove:**
@@ -291,4 +294,15 @@ This NIP builds on and is compatible with several existing community proposals:
 
 ## Reference implementation
 
-A static, client-side-only web implementation exists at `https://laantungir.net/post-quantum/`. All cryptographic operations (BIP39, BIP32, PQ keygen/sign/verify, OTS submission and verification) happen in the browser. No private key ever touches a server. Source: [`www/js/pq-crypto.mjs`](www/js/pq-crypto.mjs:1) in this repository.
+> **⚠️ Research prototype.** The implementation is experimental and is not a complete post-quantum
+> migration. It links PQ keys to an existing identity and anchors that link in Bitcoin; it does not
+> yet define PQ authentication for routine events, key rotation/revocation, or PQ encryption.
+
+A static, client-side-only web implementation exists at `https://laantungir.net/post-quantum/`.
+Cryptographic operations (BIP39, BIP32, PQ keygen/sign/verify, OTS submission and Merkle-path
+verification) happen in the browser. Private keys are handled in the browser or via a NIP-07 signer
+extension, which may be a remote signer (NIP-46); in that case the signing key does not touch the
+page origin. OTS proof *upgrading* uses a server-side helper, and Bitcoin block-header confirmation
+relies on a public explorer API (mempool.space) — this is **API-assisted verification**, not a full
+Bitcoin light-client verification. Source: [`www/js/pq-crypto.mjs`](www/js/pq-crypto.mjs:1) in this
+repository.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "post_quantum_nostr",
-  "version": "0.0.14",
+  "version": "0.0.20",
   "description": "A migration strategy for bringing post-quantum security to Nostr without breaking the social graph, without requiring consensus on a single post-quantum algorithm, and without forcing existing users to abandon their identities.",
   "main": "index.js",
   "scripts": {

research/amber_integration_analysis.md

@@ -1,5 +1,9 @@
 # Amber Integration Analysis for PQ Nostr Web App
 
+> **⚠️ Design-only research document.** This is an analysis of a possible integration, not an
+> implemented feature. The current system is a research prototype and does not make Nostr
+> identities post-quantum secure by itself.
+
 ## Amber Capabilities (from source code analysis)
 
 [Amber](https://github.com/greenart7c3/Amber) is an Android Nostr event signer that keeps the nsec segregated in a dedicated app. Based on source code inspection:

research/amber_integration_plan.md

@@ -1,5 +1,9 @@
 # Amber Integration Plan: End-User Experience
 
+> **⚠️ Design-only research document.** This describes a planned user experience, not a shipped
+> feature. The current system is a research prototype; it links PQ keys to an identity and anchors
+> that link in Bitcoin, but does not by itself make the identity post-quantum secure.
+
 ## Overview
 
 This document describes the complete end-to-end user experience for migrating a Nostr identity to post-quantum security using the PQ web app and Amber signer. There are **two paths** depending on how the user's account was created in Amber:

research/existing_pq_proposals.md

@@ -1,5 +1,7 @@
 # Existing Post-Quantum Proposals in the Nostr Ecosystem
 
+> **⚠️ Research document.** A survey of community discussion; not an implementation spec.
+
 A survey of pull requests and issues in `nostr-protocol/nips` related to post-quantum cryptography, key migration, and key rotation — and how they compare to our plan in [`README.md`](../README.md).
 
 Research date: 2026-07-12

research/nip_qr_two_account_flow.md

@@ -1,5 +1,9 @@
 # NIP-QR: Two-Account Flow Architecture
 
+> **⚠️ Design-only research document.** This describes the proposed architecture; the current
+> implementation is a research prototype and does not by itself make Nostr identities
+> post-quantum secure.
+
 ## The Flow (as proposed)
 
 ```

research/pq_js_packages_survey.md

@@ -1,5 +1,7 @@
 # Post-Quantum Cryptography: JavaScript Package Survey
 
+> **⚠️ Research document.** A library survey; not an implementation spec.
+
 ## Executive Summary
 
 **We do NOT need to write our own implementations.** There are mature, well-maintained JavaScript packages for all NIST-standardized post-quantum algorithms. The standout recommendation is **[`@noble/post-quantum`](https://www.npmjs.com/package/@noble/post-quantum)** — a pure JavaScript implementation of all FIPS 203/204/205 algorithms, from the highly respected noble cryptography family (335 GitHub stars, MIT licensed, self-audited, actively maintained).

test/pq-crypto.test.mjs

@@ -31,18 +31,41 @@ const m = await import('../www/js/pq-crypto.mjs');
 // ============================================================================
 
 describe('BIP39 seed phrase', () => {
-  test('generateSeedPhrase produces a valid 12-word mnemonic', () => {
+  test('generateSeedPhrase defaults to a valid 24-word mnemonic', () => {
     const mnemonic = m.generateSeedPhrase();
     assert.ok(m.isValidMnemonic(mnemonic), 'generated mnemonic should be valid');
     const words = mnemonic.split(' ');
-    assert.equal(words.length, 12, 'should be 12 words');
+    assert.equal(words.length, 24, 'default should be 24 words');
   });
 
-  test('generateSeedPhraseWithEntropy produces a valid mnemonic', () => {
+  test('generateSeedPhrase(128) produces a valid 12-word mnemonic', () => {
+    const mnemonic = m.generateSeedPhrase(128);
+    assert.ok(m.isValidMnemonic(mnemonic), 'generated mnemonic should be valid');
+    assert.equal(mnemonic.split(' ').length, 12, 'should be 12 words');
+  });
+
+  test('generateSeedPhrase rejects invalid entropyBits', () => {
+    assert.throws(() => m.generateSeedPhrase(64), /entropyBits must be 128/);
+    assert.throws(() => m.generateSeedPhrase(192), /entropyBits must be 128/);
+  });
+
+  test('generateSeedPhraseWithEntropy defaults to a 24-word mnemonic', () => {
     const userEntropy = new TextEncoder().encode('test entropy from user');
     const mnemonic = m.generateSeedPhraseWithEntropy(userEntropy);
     assert.ok(m.isValidMnemonic(mnemonic), 'mnemonic with entropy should be valid');
-    assert.equal(mnemonic.split(' ').length, 12);
+    assert.equal(mnemonic.split(' ').length, 24, 'default should be 24 words');
+  });
+
+  test('generateSeedPhraseWithEntropy(128) produces a 12-word mnemonic', () => {
+    const userEntropy = new TextEncoder().encode('test entropy from user');
+    const mnemonic = m.generateSeedPhraseWithEntropy(userEntropy, 128);
+    assert.ok(m.isValidMnemonic(mnemonic), 'mnemonic with entropy should be valid');
+    assert.equal(mnemonic.split(' ').length, 12, 'should be 12 words');
+  });
+
+  test('generateSeedPhraseWithEntropy rejects invalid entropyBits', () => {
+    const userEntropy = new TextEncoder().encode('test entropy');
+    assert.throws(() => m.generateSeedPhraseWithEntropy(userEntropy, 64), /entropyBits must be 128/);
   });
 
   test('generateSeedPhraseWithEntropy produces different mnemonics for different CSPRNG draws', () => {
@@ -696,3 +719,273 @@ describe('G56-03: identity binding (verifyNIPQRContent)', () => {
     assert.equal(result.identityBound, true, 'without options, identity binding should pass');
   });
 });
+
+// ============================================================================
+// G56-07: Fuzz / property tests — untrusted input must never throw
+// ============================================================================
+
+describe('G56-07: verifyNostrEvent never throws on malformed input', () => {
+  const malformedInputs = [
+    null,
+    undefined,
+    'string',
+    42,
+    true,
+    [],
+    {},
+    { id: 'abc' },
+    { pubkey: 'x', sig: 'y', created_at: 'not-a-number', kind: 1, tags: [], content: '' },
+    { pubkey: 'x', sig: 'y', created_at: 1, kind: 'not-a-number', tags: [], content: '' },
+    { pubkey: 'x', sig: 'y', created_at: 1, kind: 1, tags: 'not-an-array', content: '' },
+    { pubkey: 'x', sig: 'y', created_at: 1, kind: 1, tags: [], content: 123 },
+    { pubkey: 123, sig: 'y', created_at: 1, kind: 1, tags: [], content: '' },
+    { pubkey: 'x', sig: 123, created_at: 1, kind: 1, tags: [], content: '' },
+  ];
+
+  for (const input of malformedInputs) {
+    test(`verifyNostrEvent returns false for ${JSON.stringify(input)?.substring(0, 50)}`, () => {
+      assert.equal(m.verifyNostrEvent(input), false);
+    });
+  }
+
+  test('verifyNostrEvent returns false for random-shaped objects (fuzz)', () => {
+    const types = [null, true, false, 0, 1, 'x', '', [], {}, { id: 1 }, { tags: 'x' }];
+    for (let i = 0; i < 500; i++) {
+      const obj = {};
+      const keys = ['id', 'pubkey', 'sig', 'created_at', 'kind', 'tags', 'content', 'extra'];
+      for (const k of keys) {
+        if (Math.random() < 0.6) obj[k] = types[Math.floor(Math.random() * types.length)];
+      }
+      assert.equal(m.verifyNostrEvent(obj), false, `threw or passed for iteration ${i}`);
+    }
+  });
+});
+
+describe('G56-07: verifyNIPQRContent never throws on arbitrary input', () => {
+  function randomJson() {
+    const types = [null, true, false, 0, 'x', [], {}, { id: 1 }, { tags: 'not-array' }];
+    return types[Math.floor(Math.random() * types.length)];
+  }
+
+  test('random content + tags never throw and never pass (fuzz)', () => {
+    for (let i = 0; i < 1000; i++) {
+      const content = Math.random() < 0.5
+        ? JSON.stringify(randomJson())
+        : 'not-json-at-' + i;
+      const tags = Math.random() < 0.5
+        ? randomJson()
+        : (Math.random() < 0.5 ? [['algorithm', 'x']] : 'not-an-array');
+      let result;
+      assert.doesNotThrow(() => {
+        result = m.verifyNIPQRContent(content, tags);
+      }, `threw on iteration ${i}`);
+      assert.equal(result.validForMigration, false, `passed on iteration ${i}`);
+    }
+  });
+
+  test('null / undefined / wrong-typed content returns structured failure', () => {
+    for (const content of [null, undefined, 42, true, {}]) {
+      let result;
+      assert.doesNotThrow(() => {
+        result = m.verifyNIPQRContent(content, []);
+      });
+      assert.equal(result.validForMigration, false);
+    }
+  });
+
+  test('oversized content is rejected before parsing', () => {
+    const huge = 'x'.repeat(70 * 1024); // > MAX_EVENT_JSON_SIZE (64 KiB)
+    const result = m.verifyNIPQRContent(huge, []);
+    assert.equal(result.validForMigration, false);
+    assert.ok(result.errors.some(e => e.includes('maximum size')), 'should report size error');
+  });
+});
+
+describe('G56-07: parseOtsFile never throws on random/truncated/oversized bytes', () => {
+  test('random bytes never throw (fuzz)', () => {
+    for (let i = 0; i < 2000; i++) {
+      const len = Math.floor(Math.random() * 2048);
+      const bytes = new Uint8Array(len);
+      for (let j = 0; j < len; j++) bytes[j] = Math.floor(Math.random() * 256);
+      let result;
+      assert.doesNotThrow(() => { result = m.parseOtsFile(bytes); }, `threw on iteration ${i}, len=${len}`);
+      // result is either null or a valid parse object — never throws
+      if (result !== null) {
+        assert.ok(typeof result === 'object' && 'fileHashOp' in result, 'should be null or valid object');
+      }
+    }
+  });
+
+  test('non-Uint8Array inputs return null without throwing', () => {
+    for (const input of [null, undefined, 'string', 42, true, [], {}, new Int8Array(10)]) {
+      assert.equal(m.parseOtsFile(input), null);
+    }
+  });
+
+  test('oversized input returns null without parsing', () => {
+    const huge = new Uint8Array(2 * 1024 * 1024); // 2 MiB > MAX_OTS_PROOF_SIZE (1 MiB)
+    assert.equal(m.parseOtsFile(huge), null);
+  });
+
+  test('truncated valid-prefix bytes never throw', () => {
+    // OTS magic header as a starting point
+    const magic = m.hexToBytes('004f70656e54696d657374616d7073000050726f6f6600bf89e2e884e89294');
+    for (let cut = 0; cut <= magic.length; cut++) {
+      const truncated = magic.slice(0, cut);
+      let result;
+      assert.doesNotThrow(() => { result = m.parseOtsFile(truncated); });
+      // short truncations return null (too short); longer ones may parse partially or return null
+      assert.ok(result === null || typeof result === 'object');
+    }
+  });
+});
+
+describe('G56-07: isOtsConfirmed never throws on bad input', () => {
+  test('non-Uint8Array and random bytes never throw', () => {
+    for (const input of [null, undefined, 'string', 42, [], {}]) {
+      assert.doesNotThrow(() => m.isOtsConfirmed(input));
+    }
+    for (let i = 0; i < 200; i++) {
+      const len = Math.floor(Math.random() * 512);
+      const bytes = new Uint8Array(len);
+      for (let j = 0; j < len; j++) bytes[j] = Math.floor(Math.random() * 256);
+      assert.doesNotThrow(() => m.isOtsConfirmed(bytes), `threw on iteration ${i}`);
+    }
+  });
+});
+
+// ============================================================================
+// G56-05: Signer output validation
+// ============================================================================
+
+describe('G56-05: validateSignerOutput', () => {
+  const sk = new Uint8Array(32);
+  sk[31] = 5;
+  const pkHex = m.bytesToHex(schnorr.getPublicKey(sk));
+  const otherSk = new Uint8Array(32);
+  otherSk[31] = 9;
+  const otherPkHex = m.bytesToHex(schnorr.getPublicKey(otherSk));
+
+  // Helper: create a valid template + correctly signed event
+  function makeValidSignedEvent(content = 'test content', tags = [['t', 'x']]) {
+    const template = {
+      pubkey: pkHex,
+      created_at: 1700000000,
+      kind: 1,
+      tags,
+      content
+    };
+    const event = { ...template };
+    event.id = m.computeEventId(event);
+    event.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(event.id), sk));
+    return { template, event };
+  }
+
+  test('valid signer output passes validation', () => {
+    const { template, event } = makeValidSignedEvent();
+    const result = m.validateSignerOutput(event, template, pkHex);
+    assert.equal(result.id, event.id);
+    assert.equal(result.sig, event.sig);
+  });
+
+  test('signer changes content → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, content: 'tampered content' };
+    // Recompute id+sig so the tampered event is internally consistent
+    // (a real malicious signer would do this, but the content must still match the template)
+    tampered.id = m.computeEventId(tampered);
+    tampered.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(tampered.id), sk));
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /content was changed/);
+  });
+
+  test('signer changes tags → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, tags: [['t', 'x'], ['extra', 'tag']] };
+    tampered.id = m.computeEventId(tampered);
+    tampered.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(tampered.id), sk));
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /tags length changed/);
+  });
+
+  test('signer changes created_at → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, created_at: 9999999999 };
+    tampered.id = m.computeEventId(tampered);
+    tampered.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(tampered.id), sk));
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /created_at changed/);
+  });
+
+  test('signer changes kind → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, kind: 9999 };
+    tampered.id = m.computeEventId(tampered);
+    tampered.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(tampered.id), sk));
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /kind changed/);
+  });
+
+  test('signer returns wrong pubkey → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    // Sign with a different key, use that key's pubkey
+    const tampered = { ...template, pubkey: otherPkHex };
+    tampered.id = m.computeEventId(tampered);
+    tampered.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(tampered.id), otherSk));
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /pubkey mismatch/);
+  });
+
+  test('signer returns wrong ID → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, id: '0'.repeat(64) };
+    // sig is valid for the real id, not for '0'.repeat(64)
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /id mismatch/);
+  });
+
+  test('signer returns invalid signature → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, sig: 'f'.repeat(128) };
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /invalid Schnorr signature/);
+  });
+
+  test('signer returns extra field → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, extra: 'malicious' };
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /unexpected extra field/);
+  });
+
+  test('signer returns missing field → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const { sig, ...noSig } = event;
+    assert.throws(() => m.validateSignerOutput(noSig, template, pkHex), /missing field 'sig'/);
+  });
+
+  test('signer returns non-object → rejected', () => {
+    const { template } = makeValidSignedEvent();
+    assert.throws(() => m.validateSignerOutput(null, template, pkHex), /non-object/);
+    assert.throws(() => m.validateSignerOutput('string', template, pkHex), /non-object/);
+  });
+
+  test('signer returns malformed id (not 64 hex) → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, id: 'short' };
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /id must be 64/);
+  });
+
+  test('signer returns malformed sig (not 128 hex) → rejected', () => {
+    const { template, event } = makeValidSignedEvent();
+    const tampered = { ...event, sig: 'short' };
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /sig must be 128/);
+  });
+
+  test('no expectedPubkey → pubkey check skipped', () => {
+    const { template, event } = makeValidSignedEvent();
+    // Should pass without expectedPubkey (backward compatible)
+    const result = m.validateSignerOutput(event, template);
+    assert.equal(result.id, event.id);
+  });
+
+  test('tag element value changed → rejected', () => {
+    const { template, event } = makeValidSignedEvent('test', [['t', 'original']]);
+    const tampered = { ...event, tags: [['t', 'changed']] };
+    tampered.id = m.computeEventId(tampered);
+    tampered.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(tampered.id), sk));
+    assert.throws(() => m.validateSignerOutput(tampered, template, pkHex), /tag 0 element 1 changed/);
+  });
+});

why_what_how.md

@@ -1,5 +1,10 @@
 # Post-Quantum Nostr: Why, What, How
 
+> **⚠️ Research prototype.** This document describes an experimental pre-quantum key-commitment
+> and identity-link system. It does not, by itself, make a Nostr identity post-quantum secure;
+> complete migration requires companion protocols (PQ event authentication, rotation, encryption,
+> client adoption) that are not yet specified or implemented.
+
 ## Why: The Problem
 
 ### Quantum computers will break Nostr's cryptography
@@ -57,7 +62,7 @@ A migration strategy that brings post-quantum security to Nostr:
 
 1. **Seed phrase as algorithm-agnostic root of trust** — A BIP39 mnemonic is pure entropy (128/256 bits). It's not tied to any cryptographic algorithm. PQ keys are derived from it deterministically using BIP32 hierarchical deterministic derivation (the same standard used by NIP-06 for secp256k1 keys), with each PQ algorithm at a different child index under the NIP-06 base path. Same seed always produces the same PQ keys. The seed is quantum-safe (symmetric KDF, Grover's quadratic speedup is negligible).
 
-2. **Multi-scheme cross-signed key-link events** — Two Nostr events (a kind 1 announcement and a kind 11112 wrapper) that link a user's secp256k1 identity to multiple PQ keys simultaneously: ML-DSA-44 and ML-DSA-65 (lattice-based signatures), SLH-DSA-128s (hash-based signatures), Falcon-512 (lattice-based signatures), and ML-KEM-768 (lattice-based KEM for encryption). Each PQ signature scheme independently signs the attestation text. If one scheme is later broken, the others remain valid.
+2. **Multi-scheme cross-signed key-link events** — Two Nostr events (a kind 1 announcement and a kind 9999 proof carrier) that link a user's secp256k1 identity to multiple PQ keys simultaneously: ML-DSA-44 and ML-DSA-65 (lattice-based signatures), SLH-DSA-128s (hash-based signatures), Falcon-512 (lattice-based signatures), and ML-KEM-768 (lattice-based KEM for encryption). Each PQ signature scheme independently signs the attestation text. If one scheme is later broken, the others remain valid.
 
 3. **OpenTimestamps for pre-quantum anchoring** — The key-link event is timestamped via NIP-03 (OpenTimestamps), anchoring it to a Bitcoin block. This prevents a future quantum attacker from backdating a fraudulent key-link event, because they cannot produce a valid OTS proof for a past Bitcoin block (re-mining historical blocks is infeasible even with a quantum computer).
 
@@ -84,7 +89,7 @@ A migration strategy that brings post-quantum security to Nostr:
 Account #1 (existing identity, social graph knows this npub)
     |
     | signs: "I authorize this migration to these PQ keys"
-    |        (secp256k1 Schnorr signature on the kind 1 and kind 11112 events,
+    |        (secp256k1 Schnorr signature on the kind 1 and kind 9999 events,
     |         valid pre-quantum)
     v
 Kind 1 announcement event (published under Account #1's pubkey)
@@ -97,7 +102,7 @@ Kind 1 announcement event (published under Account #1's pubkey)
     | OpenTimestamps anchor of the kind 1 event hash to Bitcoin block
     | (proves the event existed at this time, pre-quantum)
     v
-Kind 11112 wrapper event (carries the OTS proof, embeds the kind 1 event)
+Kind 9999 proof carrier event (carries the OTS proof, embeds the kind 1 event)
     |
     v
     Published to Nostr relays
@@ -130,11 +135,11 @@ The migration uses **two Nostr events**:
 
 The content is a human-readable attestation statement. Each PQ signature scheme signs `TextEncoder.encode(content)`. The PQ public keys and signatures go in the `algorithm` tags. ML-KEM-768 has only a pubkey tag (no signature — it's a KEM).
 
-#### Kind 11112 wrapper (machine-verifiable, carries the OTS proof)
+#### Kind 9999 proof carrier (machine-verifiable, carries the OTS proof)
 
 ```json
 {
-  "kind": 11112,
+  "kind": 9999,
   "pubkey": "<Account #1 secp256k1 pubkey>",
   "content": "<JSON string of the full signed kind 1 event>",
   "tags": [
@@ -174,10 +179,10 @@ A static web page (no backend with secrets) that:
 1. **Signs in** — uses nostr-login-lite (NIP-46 bunker, seed phrase, or browser extension) to authenticate with the user's existing Nostr identity
 2. **Generates a seed phrase** — 12-word BIP39 mnemonic, generated client-side, never sent to any server
 3. **Derives PQ keys** — uses `@noble/post-quantum` (pure JavaScript, no WASM) to generate ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512, and ML-KEM-768 keypairs from the seed via BIP32 derivation paths
-4. **Signs the events** — PQ signatures are created in the browser; the secp256k1 signature is requested from the user's signer (via `window.nostr.signEvent()`) for both the kind 1 announcement and the kind 11112 wrapper
-5. **Timestamps the kind 1 event** — submits the SHA-256 of the full signed kind 1 event JSON to OpenTimestamps and embeds the proof in the kind 11112 wrapper
+4. **Signs the events** — PQ signatures are created in the browser; the secp256k1 signature is requested from the user's signer (via `window.nostr.signEvent()`) for both the kind 1 announcement and the kind 9999 proof carrier
+5. **Timestamps the kind 1 event** — submits the SHA-256 of the full signed kind 1 event JSON to OpenTimestamps and embeds the proof in the kind 9999 proof carrier
 6. **Publishes to relays** — sends both events to Nostr relays via direct WebSocket
-7. **Polls for Bitcoin confirmation** — upgrades the OTS proof and republishes the kind 11112 wrapper with the confirmed proof
+7. **Polls for Bitcoin confirmation** — upgrades the OTS proof and republishes the kind 9999 proof carrier with the confirmed proof
 8. **Shows the result** — displays the complete event JSON and event ID
 
 All cryptographic operations happen either in the browser (JavaScript/WASM) or in the user's signer (Amber, browser extension, or bunker). No private key ever touches a server.
@@ -213,7 +218,7 @@ We use multiple schemes simultaneously because:
 
 ### The demo
 
-A working demo is deployed at **https://laantungir.net/post-quantum** that implements the full flow: sign in, generate seed, derive PQ keys, sign the kind 1 and kind 11112 events, publish to relays, and timestamp via OpenTimestamps. It uses:
+A working demo is deployed at **https://laantungir.net/post-quantum** that implements the full flow: sign in, generate seed, derive PQ keys, sign the kind 1 and kind 9999 events, publish to relays, and timestamp via OpenTimestamps. It uses:
 
 - `@noble/post-quantum` for PQ cryptography (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512, ML-KEM-768)
 - `@scure/bip39` for seed phrase generation

www/index.html

@@ -292,7 +292,7 @@
         </div>
         <div class="pq-checklist-item" id="step-2">
           <span class="pq-checklist-box"></span>
-          <span>2. Generate a quantum-safe seed phrase</span>
+          <span>2. Generate a seed phrase</span>
         </div>
         <div class="pq-checklist-item" id="step-3">
           <span class="pq-checklist-box"></span>
@@ -324,13 +324,18 @@
       <div id="pqNotAuthed" class="pq-card">
         <div class="pq-card-title">Post-Quantum Nostr</div>
         <div class="pq-info-text" style="font-size: 16px; color: var(--primary-color);">
-          Make your Nostr identity quantum-resistant
+          Create an experimental pre-quantum PQ key commitment
         </div>
         <div class="pq-info-text">
           Sign in with your Nostr signer to begin. Your npub won't change, your followers stay,
-          and your social graph is preserved. We'll generate a quantum-safe seed phrase and link
+          and your social graph is preserved. We'll generate a seed phrase and link
           it to your current identity.
         </div>
+        <div class="pq-info-text" style="font-size: 13px; color: var(--accent-color);">
+          <strong>Research prototype.</strong> Do not enter a valuable existing mnemonic. This tool
+          does not make your Nostr identity post-quantum secure on its own; it creates a commitment
+          that future PQ protocols can build on.
+        </div>
         <div class="pq-info-text" id="noSignerWarning" style="color: var(--accent-color); display: none;">
           No Nostr signer detected. Install a NIP-07 browser extension (like nos2x or Alby) and reload.
         </div>
@@ -352,7 +357,7 @@
         <div class="pq-info-text">
           This tool will:
           <ol>
-            <li>Generate a new <strong>seed phrase</strong> (your quantum-safe backup)</li>
+            <li>Generate a new <strong>seed phrase</strong> (your recovery backup)</li>
             <li>Derive <strong>post-quantum keys</strong> from that seed via BIP32 paths (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512, ML-KEM-768)</li>
             <li>Sign a <strong>NIP-QR migration event</strong> linking your identity to the PQ keys</li>
             <li>Publish the event to relays</li>
@@ -363,12 +368,17 @@
 
       <!-- STEP 2: SEED PHRASE GENERATION -->
       <div id="pqSeedStep" class="pq-card pq-hidden">
-        <div class="pq-card-title">Your Quantum-Safe Seed Phrase</div>
+        <div class="pq-card-title">Your Seed Phrase</div>
         <div class="pq-info-text">
-          Your seed phrase is your <strong>quantum-safe root of trust</strong>. All post-quantum keys
+          Your seed phrase is your <strong>recovery root</strong>. All post-quantum keys
           are derived from it. It is processed entirely in your browser and never sent to any server.
           The code is open source and auditable.
         </div>
+        <div class="pq-info-text" style="font-size: 13px; color: var(--accent-color);">
+          <strong>Back this up offline.</strong> Anyone with this phrase can derive your PQ private keys.
+          24 words (256 bits) is recommended; 12 words (128 bits) is offered for testing only and is
+          weaker under a quantum brute-force model.
+        </div>
 
         <!-- Mode toggle + copy row (always visible) -->
         <div class="pq-button-row" style="margin-bottom: 15px;">
@@ -379,6 +389,11 @@
 
         <!-- Generate mode -->
         <div id="pqSeedGeneratePanel">
+          <!-- Word-count selector -->
+          <div class="pq-info-text" style="margin-bottom: 10px; font-size: 13px;">
+            <label style="margin-right: 12px;"><input type="radio" name="pqWordCount" value="256" id="pqWordCount24" checked> 24 words (recommended)</label>
+            <label><input type="radio" name="pqWordCount" value="128" id="pqWordCount12"> 12 words (testing only)</label>
+          </div>
           <div class="pq-seed-display" id="pqSeedDisplay"></div>
           <div class="pq-info-text" style="margin-top: 15px; font-size: 13px;">
             <strong>Optional:</strong> Add extra entropy by moving your mouse and typing in the box below.
@@ -465,7 +480,7 @@
         <div class="pq-card-title">Sign Migration Event</div>
         <div class="pq-info-text">
           We'll now create two events: a kind 1 announcement (public, visible in Nostr feeds) and
-          a kind 11112 wrapper (carries the OpenTimestamps proof). Each PQ key signs the attestation
+          a kind 9999 proof carrier (carries the OpenTimestamps proof). Each PQ key signs the attestation
           statement, and your signer signs both events with your secp256k1 key. The SHA-256 of the
           full kind 1 event (including its secp256k1 signature) is submitted to OpenTimestamps.
         </div>
@@ -482,7 +497,7 @@
         <div class="pq-card-title">Review & Publish Events</div>
         <div class="pq-info-text">
           Two events have been signed: a kind 1 announcement (public, visible in Nostr feeds) and
-          a kind 11112 wrapper (carries the OpenTimestamps proof). Review them below, then publish
+          a kind 9999 proof carrier (carries the OpenTimestamps proof). Review them below, then publish
           both to relays when ready.
         </div>
 
@@ -490,11 +505,11 @@
         <div id="pqKind1IdDisplay" style="margin: 5px 0; font-size: 11px; color: var(--primary-color); word-break: break-all;"></div>
         <div class="pq-event-preview" id="pqKind1Preview" style="max-height: 200px;"></div>
 
-        <div class="pq-info-text" style="margin-top: 15px; margin-bottom: 5px;"><strong>Kind 11112 wrapper event:</strong></div>
+        <div class="pq-info-text" style="margin-top: 15px; margin-bottom: 5px;"><strong>Kind 9999 proof carrier event:</strong></div>
         <div id="pqEventIdDisplay" style="margin: 5px 0; font-size: 11px; color: var(--primary-color); word-break: break-all;"></div>
         <div class="pq-event-preview" id="pqSuccessEventPreview"></div>
         <div class="pq-button-row" style="margin-top: 10px;">
-          <button class="pq-button pq-button-secondary" id="pqCopyKind11112Btn">Copy Kind 11112 Event</button>
+          <button class="pq-button pq-button-secondary" id="pqCopyProofCarrierBtn">Copy Proof Carrier Event</button>
         </div>
 
         <div style="margin-top: 15px;">
@@ -521,7 +536,7 @@
         <div class="pq-card-title">OpenTimestamps Attestation - Leave This Page Open</div>
         <div class="pq-info-text">
           Your event hash has already been submitted to OpenTimestamps in the previous step, and a
-          <strong>pending</strong> timestamp proof is embedded in the kind 11112 event you just published.
+          <strong>pending</strong> timestamp proof is embedded in the kind 9999 event you just published.
           OpenTimestamps anchors that hash into the Bitcoin blockchain, proving your event existed at this
           point in time — preventing a future quantum attacker from backdating a fraudulent event.
         </div>
@@ -529,8 +544,9 @@
           Bitcoin confirmation typically takes <strong>10-30 minutes</strong>. You can
           <strong style="text-decoration: underline;">leave this page open</strong>
           to watch the progress below — the polling log updates every minute. Once the Bitcoin attestation is
-          confirmed, this page will automatically re-sign and republish the kind 11112 event with the upgraded
-          proof. You're free to close the page; the workflow resumes on your next visit.
+          confirmed, this page will automatically sign and publish a <strong>new</strong> kind 9999 event carrying
+          the upgraded (confirmed) proof, referencing the original via an <code>upgrade_of</code> tag. The original
+          event remains on relays permanently. You're free to close the page; the workflow resumes on your next visit.
         </div>
         <div id="pqOtsStatus"></div>
 
@@ -545,7 +561,7 @@
           </div>
           <div class="pq-checklist-item pq-done" id="pqOtsPendingPublish">
             <span class="pq-checklist-box"></span>
-            <span>Pending proof embedded in kind 11112 event</span>
+            <span>Pending proof embedded in kind 9999 event</span>
           </div>
           <div class="pq-checklist-item pq-active" id="pqOtsConfirm">
             <span class="pq-checklist-box"></span>
@@ -555,7 +571,7 @@
           </div>
           <div class="pq-checklist-item" id="pqOtsConfirmedPublish">
             <span class="pq-checklist-box"></span>
-            <span>Republish kind 11112 with confirmed proof — automatic on confirmation</span>
+            <span>Publish new kind 9999 with confirmed proof — automatic on confirmation</span>
           </div>
         </div>
         <div id="pqOtsProofWrap" class="pq-hidden" style="margin-top: 15px;">
@@ -602,12 +618,12 @@
       deriveSecp256k1FromSeed,
       derivePQKeysFromSeed,
       buildKind1Announcement,
-      buildKind11112Wrapper,
       buildProofCarrier,
       computeEventId,
       hashFullEvent,
       verifyNIPQRContent,
       verifyNostrEvent,
+      validateSignerOutput,
       bytesToBase64,
       base64ToBytes,
       bytesToHex,
@@ -634,7 +650,7 @@
     let pqSeed = null;
     let pqKeys = null;
     let pqSecpKeys = null;
-    let pqEvent = null;       // kind 11112 wrapper event
+    let pqEvent = null;       // kind 9999 proof carrier event
     let kind1Event = null;    // kind 1 announcement event
 
     /* ================================================================
@@ -941,14 +957,21 @@
     let userEntropyChunks = [];
     let entropyCollecting = false;
 
+    function getSelectedEntropyBits() {
+      const radio = document.querySelector('input[name="pqWordCount"]:checked');
+      return radio ? parseInt(radio.value, 10) : 256;
+    }
+
     function generateAndShowSeed() {
+      const entropyBits = getSelectedEntropyBits();
       // Use user entropy if available, otherwise pure CSPRNG
       if (userEntropyChunks.length > 0) {
         const userEntropy = new TextEncoder().encode(userEntropyChunks.join(''));
-        pqMnemonic = generateSeedPhraseWithEntropy(userEntropy);
-        otsLog(`Seed generated with ${userEntropyChunks.length} entropy chunks from user input.`);
+        pqMnemonic = generateSeedPhraseWithEntropy(userEntropy, entropyBits);
+        otsLog(`Seed generated with ${userEntropyChunks.length} entropy chunks from user input (${entropyBits}-bit).`);
       } else {
-        pqMnemonic = generateSeedPhrase();
+        pqMnemonic = generateSeedPhrase(entropyBits);
+        otsLog(`Seed generated (${entropyBits}-bit).`);
       }
       const words = pqMnemonic.split(' ');
       pqSeedDisplay.innerHTML = words.map((word, i) =>
@@ -1095,16 +1118,8 @@
         setStatus(pqSignStatus, 'info', 'PQ signatures complete. Requesting secp256k1 signature for kind 1 announcement...');
 
         const kind1Signed = await window.nostr.signEvent(kind1Template);
-        // Ensure the signed event has all fields
-        kind1Event = {
-          id: kind1Signed.id,
-          pubkey: kind1Signed.pubkey,
-          created_at: kind1Template.created_at,
-          kind: 1,
-          content: kind1Template.content,
-          tags: kind1Template.tags,
-          sig: kind1Signed.sig
-        };
+        // G56-05: validate signer output — never reconstruct from mixed fields
+        kind1Event = validateSignerOutput(kind1Signed, kind1Template, currentPubkey);
         otsLog(`Kind 1 announcement signed. Event ID: ${kind1Event.id.substring(0, 32)}...`);
 
         // ---- Phase 2: Timestamp the full kind 1 event hash ----
@@ -1118,7 +1133,7 @@
           otsLog(`Pending OTS proof created (${otsProof.length} bytes) for kind 1 event hash.`);
         } catch (otsError) {
           console.warn('[post-quantum] OTS submission failed, continuing without proof:', otsError.message);
-          otsLog(`WARNING: OTS submission failed: ${otsError.message}. Kind 11112 event will not have OTS proof yet.`);
+          otsLog(`WARNING: OTS submission failed: ${otsError.message}. Kind 9999 event will not have OTS proof yet.`);
         }
 
         // ---- Phase 3: Build and sign the proof carrier event (kind 9999) ----
@@ -1135,16 +1150,8 @@
         }
 
         const proofCarrierSigned = await window.nostr.signEvent(proofCarrierTemplate);
-
-        pqEvent = {
-          id: proofCarrierSigned.id,
-          pubkey: proofCarrierSigned.pubkey,
-          created_at: proofCarrierTemplate.created_at,
-          kind: NIP_QR_KIND,
-          content: proofCarrierTemplate.content,
-          tags: proofCarrierTemplate.tags,
-          sig: proofCarrierSigned.sig
-        };
+        // G56-05: validate signer output — never reconstruct from mixed fields
+        pqEvent = validateSignerOutput(proofCarrierSigned, proofCarrierTemplate, currentPubkey);
         otsLog(`Proof carrier signed. Event ID: ${pqEvent.id.substring(0, 32)}...`);
 
         // Save the pending OTS proof for the OTS step
@@ -1248,7 +1255,7 @@
     ];
     let pqRelays = DEFAULT_RELAYS.slice();
 
-    // Per-relay publish status: { url: { kind1: bool, kind11112: bool } }
+    // Per-relay publish status: { url: { kind1: bool, kind9999: bool } }
     const pqRelayStatus = {};
 
     function makeStatusCheckbox(label) {
@@ -1266,7 +1273,7 @@
     }
 
     function setRelayStatus(url, kind, ok) {
-      if (!pqRelayStatus[url]) pqRelayStatus[url] = { kind1: false, kind11112: false };
+      if (!pqRelayStatus[url]) pqRelayStatus[url] = { kind1: false, kind9999: false };
       pqRelayStatus[url][kind] = ok;
       const row = document.querySelector(`.pq-relay-row[data-relay="${CSS.escape(url)}"]`);
       if (!row) return;
@@ -1297,9 +1304,9 @@
         k1.box.classList.add('pq-relay-status-kind1');
         row.appendChild(k1.wrap);
 
-        const k11112 = makeStatusCheckbox('k11112');
-        k11112.box.classList.add('pq-relay-status-kind11112');
-        row.appendChild(k11112.wrap);
+        const k9999 = makeStatusCheckbox('k9999');
+        k9999.box.classList.add('pq-relay-status-kind9999');
+        row.appendChild(k9999.wrap);
 
         const removeBtn = document.createElement('button');
         removeBtn.className = 'pq-button pq-button-secondary';
@@ -1318,7 +1325,7 @@
         const st = pqRelayStatus[url];
         if (st) {
           if (st.kind1) setRelayStatus(url, 'kind1', true);
-          if (st.kind11112) setRelayStatus(url, 'kind11112', true);
+          if (st.kind9999) setRelayStatus(url, 'kind9999', true);
         }
       });
     }
@@ -1363,6 +1370,21 @@
     document.getElementById('pqSeedToggleGenerate').addEventListener('click', () => showSeedGeneratePanel());
     document.getElementById('pqSeedToggleOwn').addEventListener('click', () => showSeedOwnPanel());
 
+    // Word-count selector: regenerate when the user switches between 12/24 words
+    document.querySelectorAll('input[name="pqWordCount"]').forEach((radio) => {
+      radio.addEventListener('change', () => {
+        userEntropyChunks = [];
+        generateAndShowSeed();
+        // Reset entropy UI
+        const entropyBar = document.getElementById('pqEntropyBar');
+        const entropyHint = document.getElementById('pqEntropyHint');
+        const regenWithEntropyBtn = document.getElementById('pqRegenerateWithEntropyBtn');
+        if (entropyBar) entropyBar.style.width = '0%';
+        if (entropyHint) entropyHint.textContent = 'Optional: click here and type random characters, move your mouse to add entropy...';
+        if (regenWithEntropyBtn) { regenWithEntropyBtn.classList.add('pq-hidden'); regenWithEntropyBtn.disabled = true; }
+      });
+    });
+
     // Bring your own seed: real-time validation
     const pqSeedInput = document.getElementById('pqSeedInput');
     const pqSeedValidation = document.getElementById('pqSeedValidation');
@@ -1425,15 +1447,15 @@
         const fail1 = results1.filter(r => !r.success).length;
         otsLog(`Kind 1 announcement published: ${success1} ok, ${fail1} failed.`);
 
-        // Publish kind 11112 wrapper
-        publishStatus.innerHTML = '<div class="pq-status pq-status-info">Publishing kind 11112 wrapper to relays...</div>';
+        // Publish kind 9999 proof carrier
+        publishStatus.innerHTML = '<div class="pq-status pq-status-info">Publishing kind 9999 proof carrier to relays...</div>';
         const results2 = await publishToRelays(pqEvent, relayUrls);
-        results2.forEach(r => setRelayStatus(r.relay, 'kind11112', r.success));
+        results2.forEach(r => setRelayStatus(r.relay, 'kind9999', r.success));
         const success2 = results2.filter(r => r.success).length;
         const fail2 = results2.filter(r => !r.success).length;
-        otsLog(`Kind 11112 wrapper published: ${success2} ok, ${fail2} failed.`);
+        otsLog(`Kind 9999 proof carrier published: ${success2} ok, ${fail2} failed.`);
 
-        setStatus(publishStatus, 'success', `Published! Kind 1: ${success1}/${relayUrls.length} relays. Kind 11112: ${success2}/${relayUrls.length} relays.`);
+        setStatus(publishStatus, 'success', `Published! Kind 1: ${success1}/${relayUrls.length} relays. Kind 9999: ${success2}/${relayUrls.length} relays.`);
         publishBtn.textContent = 'Published';
         publishBtn.disabled = true;
         setStepDone(5);
@@ -1473,13 +1495,13 @@
       if (e.key === 'Enter') { e.preventDefault(); document.getElementById('pqRelayAddBtn').click(); }
     });
 
-    // Copy Kind 11112 Event button
-    document.getElementById('pqCopyKind11112Btn').addEventListener('click', () => {
+    // Copy Proof Carrier Event button
+    document.getElementById('pqCopyProofCarrierBtn').addEventListener('click', () => {
       if (!pqEvent) return;
       navigator.clipboard.writeText(JSON.stringify(pqEvent, null, 2)).then(() => {
-        const btn = document.getElementById('pqCopyKind11112Btn');
+        const btn = document.getElementById('pqCopyProofCarrierBtn');
         btn.textContent = 'Copied!';
-        setTimeout(() => { btn.textContent = 'Copy Kind 11112 Event'; }, 2000);
+        setTimeout(() => { btn.textContent = 'Copy Proof Carrier Event'; }, 2000);
       });
     });
 
@@ -1578,7 +1600,7 @@
         }
         showOtsProof(pendingOtsBytes);
         setKeyIcon('pqOtsPendingPublish', 'Done');
-        otsStatus.innerHTML = '<div class="pq-status pq-status-info">Pending proof is embedded in the kind 11112 event. Waiting for Bitcoin confirmation...</div>';
+        otsStatus.innerHTML = '<div class="pq-status pq-status-info">Pending proof is embedded in the kind 9999 event. Waiting for Bitcoin confirmation...</div>';
         startOtsPolling();
         return;
       }
@@ -1600,7 +1622,7 @@
               confirmedPublished: false
             });
             setKeyIcon('pqOtsPendingPublish', 'Done');
-            otsStatus.innerHTML = '<div class="pq-status pq-status-info">Pending proof is embedded in the kind 11112 event. Waiting for Bitcoin confirmation (polling every 60 seconds)...</div>';
+            otsStatus.innerHTML = '<div class="pq-status pq-status-info">Pending proof is embedded in the kind 9999 event. Waiting for Bitcoin confirmation (polling every 60 seconds)...</div>';
             startOtsPolling();
             return;
           }
@@ -1610,7 +1632,7 @@
       }
 
       // No proof in the event — OTS submission failed during step 4.
-      // Submit the kind 1 event hash to OpenTimestamps now, then republish the event with the proof.
+      // Submit the kind 1 event hash to OpenTimestamps now, then publish a new kind 9999 event with the proof.
       const sha256Tag = pqEvent.tags && pqEvent.tags.find(t => t[0] === 'sha256');
       if (!sha256Tag || !sha256Tag[1]) {
         otsLog('ERROR: No sha256 tag found in event. Cannot timestamp.');
@@ -1628,7 +1650,7 @@
         showOtsProof(otsBytes);
 
         // Republish the event with the OTS proof embedded
-        otsStatus.innerHTML = '<div class="pq-status pq-status-info">Republishing kind 11112 event with embedded OTS proof...</div>';
+        otsStatus.innerHTML = '<div class="pq-status pq-status-info">Publishing new kind 9999 event with embedded OTS proof...</div>';
         await publishUpgradedEvent(otsBytes);
         setKeyIcon('pqOtsPendingPublish', 'Done');
         savePendingOts(pqEvent.id, otsBytes, {
@@ -1688,7 +1710,7 @@
 
             const saved = loadPendingOts();
             if (!saved || !saved.confirmedPublished) {
-              setStatus(document.getElementById('pqOtsStatus'), 'success', 'Bitcoin attestation verified. Republishing kind 11112 with confirmed proof...');
+              setStatus(document.getElementById('pqOtsStatus'), 'success', 'Bitcoin attestation verified. Publishing new kind 9999 with confirmed proof...');
               await publishUpgradedEvent(pendingOtsBytes);
             }
           } else if (isOtsConfirmed(pendingOtsBytes)) {
@@ -1724,7 +1746,7 @@
     async function publishUpgradedEvent(upgradedOtsBytes) {
       const otsStatus = document.getElementById('pqOtsStatus');
       try {
-        otsLog('Building upgraded kind 11112 event with confirmed OTS proof...');
+        otsLog('Building upgraded proof carrier with confirmed OTS proof...');
         const savedWorkflow = loadPendingOts();
         const configuredRelays = getRelayUrlsString() || (savedWorkflow && savedWorkflow.relayUrls) || 'wss://laantungir.net/relay';
 
@@ -1732,18 +1754,20 @@
         const upgradedTemplate = buildUpgradedEvent(pqEvent, upgradedOtsBytes);
 
         if (!window.nostr || !window.nostr.signEvent) throw new Error('Nostr signer not available');
-        otsLog('Requesting secp256k1 signature for upgraded kind 11112 event...');
+        otsLog('Requesting secp256k1 signature for upgraded proof carrier...');
         const signedEvent = await window.nostr.signEvent(upgradedTemplate);
+        // G56-05: validate signer output before publishing
+        const validatedEvent = validateSignerOutput(signedEvent, upgradedTemplate, currentPubkey);
         const relayUrls = configuredRelays.split(',').map(s => s.trim()).filter(Boolean);
-        const results = await publishToRelays(signedEvent, relayUrls);
+        const results = await publishToRelays(validatedEvent, relayUrls);
         const successCount = results.filter(r => r.success).length;
         const failCount = results.filter(r => !r.success).length;
-        if (successCount === 0) throw new Error('No relay accepted the upgraded kind 11112 event');
+        if (successCount === 0) throw new Error('No relay accepted the upgraded proof carrier');
 
         setKeyIcon('pqOtsConfirmedPublish', 'Done');
-        otsLog(`Upgraded kind 11112 event published. Successful: ${successCount}; failed: ${failCount}.`);
+        otsLog(`Upgraded proof carrier published. Successful: ${successCount}; failed: ${failCount}.`);
         // Update pqEvent to the new event so future operations use it
-        pqEvent = signedEvent;
+        pqEvent = validatedEvent;
         savePendingOts(pqEvent.id, upgradedOtsBytes, {
           ownerPubkey: currentPubkey,
           targetKind: NIP_QR_KIND,
@@ -1752,10 +1776,10 @@
           confirmedPublished: true
         });
 
-        setStatus(otsStatus, 'success', `Upgraded kind 11112 event published to ${successCount} relays. Timestamping complete.`);
+        setStatus(otsStatus, 'success', `Upgraded proof carrier published to ${successCount} relays. Timestamping complete.`);
         setStepDone(6);
         setStepActive(7);
-        return signedEvent;
+        return validatedEvent;
       } catch (error) {
         otsLog(`ERROR publishing upgraded event: ${error.message}`);
         setStatus(otsStatus, 'error', `Failed to publish upgraded event: ${error.message}`);

www/js/pq-crypto.mjs

@@ -70,11 +70,20 @@ const PQ_SEED_LENGTHS = {
 // ============================================================================
 
 /**
- * Generate a new 12-word BIP39 mnemonic.
- * @returns {string} 12-word seed phrase
+ * Generate a new BIP39 mnemonic.
+ *
+ * Defaults to 24 words (256 bits of entropy) so the recovery root is not the
+ * weakest link in a system whose PQ algorithms target NIST Category 1+.
+ * Pass `128` for `entropyBits` to generate a 12-word phrase (e.g. for testing).
+ *
+ * @param {number} [entropyBits=256] - 128 (12 words) or 256 (24 words)
+ * @returns {string} BIP39 seed phrase (24 words by default)
  */
-export function generateSeedPhrase() {
-    return generateMnemonic(wordlist, 128); // 128 bits = 12 words
+export function generateSeedPhrase(entropyBits = 256) {
+    if (entropyBits !== 128 && entropyBits !== 256) {
+        throw new Error('entropyBits must be 128 (12 words) or 256 (24 words)');
+    }
+    return generateMnemonic(wordlist, entropyBits);
 }
 
 /**
@@ -85,20 +94,29 @@ export function generateSeedPhrase() {
  * compromised, the seed remains unpredictable to an attacker who doesn't have
  * the user's entropy.
  *
+ * Defaults to 24 words (256 bits). Pass `128` for `entropyBits` to generate a
+ * 12-word phrase.
+ *
  * @param {Uint8Array} userEntropy - Additional entropy from the user (any length)
- * @returns {string} A valid 12-word BIP39 mnemonic
+ * @param {number} [entropyBits=256] - 128 (12 words) or 256 (24 words)
+ * @returns {string} A valid BIP39 mnemonic (24 words by default)
  */
-export function generateSeedPhraseWithEntropy(userEntropy) {
-    // Get 16 bytes (128 bits) of CSPRNG entropy
-    const csprngBytes = new Uint8Array(16);
+export function generateSeedPhraseWithEntropy(userEntropy, entropyBits = 256) {
+    if (entropyBits !== 128 && entropyBits !== 256) {
+        throw new Error('entropyBits must be 128 (12 words) or 256 (24 words)');
+    }
+    const entropyBytes = entropyBits / 8; // 16 or 32
+
+    // Get CSPRNG entropy of the requested size
+    const csprngBytes = new Uint8Array(entropyBytes);
     crypto.getRandomValues(csprngBytes);
 
     // Combine CSPRNG entropy with user entropy via SHA-256
     const combined = concatBytes(csprngBytes, userEntropy);
     const hash = sha256(combined);
 
-    // Use the first 16 bytes (128 bits) of the hash as the entropy
-    const finalEntropy = hash.slice(0, 16);
+    // Use the first `entropyBytes` bytes of the hash as the entropy
+    const finalEntropy = hash.slice(0, entropyBytes);
 
     return entropyToMnemonic(finalEntropy, wordlist);
 }
@@ -394,28 +412,162 @@ export function hexToNpub(hexPubkey) {
 /**
  * Verify a Nostr event's secp256k1 Schnorr signature (NIP-01).
  * Checks both the signature validity AND that event.id matches the computed hash.
+ *
+ * G56-07: This function accepts untrusted input (pasted JSON, relay events) and
+ * must never throw on malformed data. It returns `false` for any structurally
+ * invalid event.
+ *
  * @param {object} event - Nostr event with id, pubkey, created_at, kind, tags, content, sig
- * @returns {boolean} true if signature is valid and id matches
+ * @returns {boolean} true if signature is valid and id matches; false otherwise (never throws)
  */
 export function verifyNostrEvent(event) {
-    // Build the event hash (NIP-01 serialization)
-    const serialized = JSON.stringify([
-        0,
-        event.pubkey,
-        event.created_at,
-        event.kind,
-        event.tags,
-        event.content
-    ]);
-    const hash = sha256(new TextEncoder().encode(serialized));
-    const computedId = bytesToHex(hash);
-    // F-H2: Verify event.id matches the computed hash
-    if (event.id && event.id.toLowerCase() !== computedId.toLowerCase()) {
+    try {
+        // Structural validation — fail closed on wrong shape
+        if (!event || typeof event !== 'object') return false;
+        if (typeof event.pubkey !== 'string' || typeof event.sig !== 'string') return false;
+        if (typeof event.created_at !== 'number') return false;
+        if (typeof event.kind !== 'number') return false;
+        if (!Array.isArray(event.tags)) return false;
+        if (typeof event.content !== 'string') return false;
+
+        // Build the event hash (NIP-01 serialization)
+        const serialized = JSON.stringify([
+            0,
+            event.pubkey,
+            event.created_at,
+            event.kind,
+            event.tags,
+            event.content
+        ]);
+        const hash = sha256(new TextEncoder().encode(serialized));
+        const computedId = bytesToHex(hash);
+        // F-H2: Verify event.id matches the computed hash
+        if (event.id && event.id.toLowerCase() !== computedId.toLowerCase()) {
+            return false;
+        }
+        const sig = hexToBytes(event.sig);
+        const pubkey = hexToBytes(event.pubkey);
+        return schnorr.verify(sig, hash, pubkey);
+    } catch (e) {
+        // G56-07: never throw on untrusted malformed input
         return false;
     }
-    const sig = hexToBytes(event.sig);
-    const pubkey = hexToBytes(event.pubkey);
-    return schnorr.verify(sig, hash, pubkey);
+}
+
+/**
+ * Validate the output of a NIP-07 signer's signEvent() call (G56-05).
+ *
+ * This ensures a malicious or buggy signer cannot substitute different content,
+ * tags, pubkey, or an invalid signature. It verifies that the signed event
+ * matches the template exactly (for the semantic fields), that the pubkey
+ * equals the expected identity, that the computed ID matches, and that the
+ * Schnorr signature is valid.
+ *
+ * Returns the validated signed event object (the signer's exact object, not a
+ * reconstruction) on success, or throws on any mismatch.
+ *
+ * @param {object} signedEvent - The object returned by window.nostr.signEvent()
+ * @param {object} template - The unsigned template that was passed to signEvent()
+ * @param {string} expectedPubkey - The hex pubkey of the authenticated identity
+ * @returns {object} the validated signed event
+ * @throws {Error} if any field is missing, mismatched, or the signature is invalid
+ */
+export function validateSignerOutput(signedEvent, template, expectedPubkey) {
+    if (!signedEvent || typeof signedEvent !== 'object') {
+        throw new Error('validateSignerOutput: signer returned non-object');
+    }
+
+    // 1. Check all required fields are present and correctly typed
+    const required = ['id', 'pubkey', 'created_at', 'kind', 'tags', 'content', 'sig'];
+    for (const field of required) {
+        if (!(field in signedEvent)) {
+            throw new Error(`validateSignerOutput: missing field '${field}'`);
+        }
+    }
+    if (typeof signedEvent.id !== 'string' || !/^[0-9a-f]{64}$/.test(signedEvent.id)) {
+        throw new Error('validateSignerOutput: id must be 64 lowercase hex chars');
+    }
+    if (typeof signedEvent.pubkey !== 'string' || !/^[0-9a-f]{64}$/.test(signedEvent.pubkey)) {
+        throw new Error('validateSignerOutput: pubkey must be 64 lowercase hex chars');
+    }
+    if (typeof signedEvent.sig !== 'string' || !/^[0-9a-f]{128}$/.test(signedEvent.sig)) {
+        throw new Error('validateSignerOutput: sig must be 128 lowercase hex chars');
+    }
+    if (typeof signedEvent.created_at !== 'number') {
+        throw new Error('validateSignerOutput: created_at must be a number');
+    }
+    if (typeof signedEvent.kind !== 'number') {
+        throw new Error('validateSignerOutput: kind must be a number');
+    }
+    if (!Array.isArray(signedEvent.tags)) {
+        throw new Error('validateSignerOutput: tags must be an array');
+    }
+    if (typeof signedEvent.content !== 'string') {
+        throw new Error('validateSignerOutput: content must be a string');
+    }
+
+    // 2. Verify no template field was changed by the signer
+    if (signedEvent.kind !== template.kind) {
+        throw new Error(`validateSignerOutput: kind changed (template=${template.kind}, signed=${signedEvent.kind})`);
+    }
+    if (signedEvent.content !== template.content) {
+        throw new Error('validateSignerOutput: content was changed by signer');
+    }
+    if (signedEvent.created_at !== template.created_at) {
+        throw new Error(`validateSignerOutput: created_at changed (template=${template.created_at}, signed=${signedEvent.created_at})`);
+    }
+    // Deep-compare tags (order-sensitive, as tag order affects the event ID)
+    if (signedEvent.tags.length !== template.tags.length) {
+        throw new Error(`validateSignerOutput: tags length changed (template=${template.tags.length}, signed=${signedEvent.tags.length})`);
+    }
+    for (let i = 0; i < template.tags.length; i++) {
+        const tTag = template.tags[i];
+        const sTag = signedEvent.tags[i];
+        if (!Array.isArray(sTag) || sTag.length !== tTag.length) {
+            throw new Error(`validateSignerOutput: tag ${i} shape changed`);
+        }
+        for (let j = 0; j < tTag.length; j++) {
+            if (sTag[j] !== tTag[j]) {
+                throw new Error(`validateSignerOutput: tag ${i} element ${j} changed`);
+            }
+        }
+    }
+
+    // 3. Verify the pubkey matches the expected identity
+    if (expectedPubkey && signedEvent.pubkey !== expectedPubkey) {
+        throw new Error(`validateSignerOutput: pubkey mismatch (expected=${expectedPubkey?.substring(0, 16)}..., got=${signedEvent.pubkey.substring(0, 16)}...)`);
+    }
+
+    // 4. Recompute the event ID and verify it matches
+    const computedId = computeEventId(signedEvent);
+    if (signedEvent.id !== computedId) {
+        throw new Error(`validateSignerOutput: id mismatch (signed=${signedEvent.id.substring(0, 16)}..., computed=${computedId.substring(0, 16)}...)`);
+    }
+
+    // 5. Verify the Schnorr signature
+    const hash = sha256(new TextEncoder().encode(JSON.stringify([
+        0,
+        signedEvent.pubkey,
+        signedEvent.created_at,
+        signedEvent.kind,
+        signedEvent.tags,
+        signedEvent.content
+    ])));
+    const sig = hexToBytes(signedEvent.sig);
+    const pubkey = hexToBytes(signedEvent.pubkey);
+    if (!schnorr.verify(sig, hash, pubkey)) {
+        throw new Error('validateSignerOutput: invalid Schnorr signature');
+    }
+
+    // 6. Reject extra unexpected fields (allow only the 7 NIP-01 fields)
+    const allowedFields = new Set(['id', 'pubkey', 'created_at', 'kind', 'tags', 'content', 'sig']);
+    for (const key of Object.keys(signedEvent)) {
+        if (!allowedFields.has(key)) {
+            throw new Error(`validateSignerOutput: unexpected extra field '${key}'`);
+        }
+    }
+
+    return signedEvent;
 }
 
 // ============================================================================
@@ -677,6 +829,16 @@ export function verifyNIPQRContent(kind11112Content, kind11112Tags, options = {}
     const errors = [];
     const { expectedAuthor, outerPubkey } = options;
 
+    // G56-07: reject oversized content before any parsing/decoding work
+    if (typeof kind11112Content === 'string' && kind11112Content.length > MAX_EVENT_JSON_SIZE) {
+        return {
+            results: [{ algorithm: 'event', valid: false, note: 'content exceeds maximum size' }],
+            kind1Event: null, fullHash: null, sha256Valid: false, eTagValid: false,
+            pqProofsValid: false, policySufficient: false, identityBound: false,
+            validForMigration: false, errors: ['content exceeds maximum size']
+        };
+    }
+
     // --- Helper: push a result entry and track failures ---
     function pushResult(algorithm, valid, note) {
         results.push({ algorithm, valid, note });
@@ -1501,6 +1663,11 @@ class OtsReader {
 // OTS magic header (31 bytes)
 const OTS_MAGIC = hexToBytes('004f70656e54696d657374616d7073000050726f6f6600bf89e2e884e89294');
 
+// G56-07: Maximum sizes for untrusted inputs. Reject larger inputs before any
+// parsing or cryptographic work to prevent denial-of-service via oversized data.
+const MAX_OTS_PROOF_SIZE = 1 << 20;   // 1 MiB — generous for heavily upgraded proofs
+const MAX_EVENT_JSON_SIZE = 1 << 16;  // 64 KiB — NIP-QR events are typically 30-50 KiB
+
 // Attestation tags
 const BITCOIN_ATTESTATION_TAG = hexToBytes('0588960d73d71901');
 const LITECOIN_ATTESTATION_TAG = hexToBytes('06869a0d73d71b45');
@@ -1522,35 +1689,43 @@ function bytesEqual(a, b) {
  *   that the attestation covers (after walking the op tree from the target).
  */
 export function parseOtsFile(otsBytes) {
+    // G56-07: fail closed on untrusted input — never throw
     if (!(otsBytes instanceof Uint8Array) || otsBytes.length < OTS_MAGIC.length) return null;
+    // G56-07: reject oversized proofs before any parsing work
+    if (otsBytes.length > MAX_OTS_PROOF_SIZE) return null;
 
-    const reader = new OtsReader(otsBytes);
+    try {
+        const reader = new OtsReader(otsBytes);
 
-    // 1. Magic header
-    const magic = reader.readBytes(OTS_MAGIC.length);
-    if (!bytesEqual(magic, OTS_MAGIC)) return null;
+        // 1. Magic header
+        const magic = reader.readBytes(OTS_MAGIC.length);
+        if (!bytesEqual(magic, OTS_MAGIC)) return null;
 
-    // 2. Version (varuint) — we support major version 1
-    const version = reader.readVaruint();
-    if (version !== 1) return null;
+        // 2. Version (varuint) — we support major version 1
+        const version = reader.readVaruint();
+        if (version !== 1) return null;
 
-    // 3. File hash operation tag (1 byte)
-    const hashOpTag = reader.readByte();
-    let fileHashOp = 'unknown';
-    let digestLen = 32;
-    if (hashOpTag === 0x08) { fileHashOp = 'sha256'; digestLen = 32; }
-    else if (hashOpTag === 0x02) { fileHashOp = 'sha1'; digestLen = 20; }
-    else if (hashOpTag === 0x03) { fileHashOp = 'ripemd160'; digestLen = 20; }
-    else { return null; } // unsupported hash op
+        // 3. File hash operation tag (1 byte)
+        const hashOpTag = reader.readByte();
+        let fileHashOp = 'unknown';
+        let digestLen = 32;
+        if (hashOpTag === 0x08) { fileHashOp = 'sha256'; digestLen = 32; }
+        else if (hashOpTag === 0x02) { fileHashOp = 'sha1'; digestLen = 20; }
+        else if (hashOpTag === 0x03) { fileHashOp = 'ripemd160'; digestLen = 20; }
+        else { return null; } // unsupported hash op
 
-    // 4. File digest (the target — what was timestamped)
-    const targetDigest = reader.readBytes(digestLen);
+        // 4. File digest (the target — what was timestamped)
+        const targetDigest = reader.readBytes(digestLen);
 
-    // 5. Timestamp tree
-    const attestations = [];
-    _parseTimestamp(reader, targetDigest, attestations, 0);
+        // 5. Timestamp tree
+        const attestations = [];
+        _parseTimestamp(reader, targetDigest, attestations, 0);
 
-    return { fileHashOp, targetDigest, attestations };
+        return { fileHashOp, targetDigest, attestations };
+    } catch (e) {
+        // G56-07: never throw on malformed/truncated untrusted input
+        return null;
+    }
 }
 
 /**

www/js/version.json

@@ -1,5 +1,5 @@
 {
-  "VERSION": "v0.0.14",
-  "VERSION_NUMBER": "0.0.14",
-  "BUILD_DATE": "2026-07-24T11:16:26.143Z"
+  "VERSION": "v0.0.20",
+  "VERSION_NUMBER": "0.0.20",
+  "BUILD_DATE": "2026-07-24T13:42:06.579Z"
 }

www/pq-crypto.bundle.js

@@ -9609,15 +9609,22 @@ var PQ_SEED_LENGTHS = {
   falcon512: 48,
   mlKem: 64
 };
-function generateSeedPhrase() {
-  return generateMnemonic(wordlist, 128);
+function generateSeedPhrase(entropyBits = 256) {
+  if (entropyBits !== 128 && entropyBits !== 256) {
+    throw new Error("entropyBits must be 128 (12 words) or 256 (24 words)");
+  }
+  return generateMnemonic(wordlist, entropyBits);
 }
-function generateSeedPhraseWithEntropy(userEntropy) {
-  const csprngBytes = new Uint8Array(16);
+function generateSeedPhraseWithEntropy(userEntropy, entropyBits = 256) {
+  if (entropyBits !== 128 && entropyBits !== 256) {
+    throw new Error("entropyBits must be 128 (12 words) or 256 (24 words)");
+  }
+  const entropyBytes = entropyBits / 8;
+  const csprngBytes = new Uint8Array(entropyBytes);
   crypto.getRandomValues(csprngBytes);
   const combined = concatBytes4(csprngBytes, userEntropy);
   const hash = sha256(combined);
-  const finalEntropy = hash.slice(0, 16);
+  const finalEntropy = hash.slice(0, entropyBytes);
   return entropyToMnemonic(finalEntropy, wordlist);
 }
 function mnemonicToSeed(mnemonic, passphrase = "") {
@@ -9754,22 +9761,115 @@ function hexToNpub(hexPubkey) {
   return bech32.encode("npub", bech32.toWords(bytes));
 }
 function verifyNostrEvent(event) {
-  const serialized = JSON.stringify([
-    0,
-    event.pubkey,
-    event.created_at,
-    event.kind,
-    event.tags,
-    event.content
-  ]);
-  const hash = sha256(new TextEncoder().encode(serialized));
-  const computedId = bytesToHex3(hash);
-  if (event.id && event.id.toLowerCase() !== computedId.toLowerCase()) {
+  try {
+    if (!event || typeof event !== "object") return false;
+    if (typeof event.pubkey !== "string" || typeof event.sig !== "string") return false;
+    if (typeof event.created_at !== "number") return false;
+    if (typeof event.kind !== "number") return false;
+    if (!Array.isArray(event.tags)) return false;
+    if (typeof event.content !== "string") return false;
+    const serialized = JSON.stringify([
+      0,
+      event.pubkey,
+      event.created_at,
+      event.kind,
+      event.tags,
+      event.content
+    ]);
+    const hash = sha256(new TextEncoder().encode(serialized));
+    const computedId = bytesToHex3(hash);
+    if (event.id && event.id.toLowerCase() !== computedId.toLowerCase()) {
+      return false;
+    }
+    const sig = hexToBytes3(event.sig);
+    const pubkey = hexToBytes3(event.pubkey);
+    return schnorr.verify(sig, hash, pubkey);
+  } catch (e) {
     return false;
   }
-  const sig = hexToBytes3(event.sig);
-  const pubkey = hexToBytes3(event.pubkey);
-  return schnorr.verify(sig, hash, pubkey);
+}
+function validateSignerOutput(signedEvent, template, expectedPubkey) {
+  if (!signedEvent || typeof signedEvent !== "object") {
+    throw new Error("validateSignerOutput: signer returned non-object");
+  }
+  const required = ["id", "pubkey", "created_at", "kind", "tags", "content", "sig"];
+  for (const field of required) {
+    if (!(field in signedEvent)) {
+      throw new Error(`validateSignerOutput: missing field '${field}'`);
+    }
+  }
+  if (typeof signedEvent.id !== "string" || !/^[0-9a-f]{64}$/.test(signedEvent.id)) {
+    throw new Error("validateSignerOutput: id must be 64 lowercase hex chars");
+  }
+  if (typeof signedEvent.pubkey !== "string" || !/^[0-9a-f]{64}$/.test(signedEvent.pubkey)) {
+    throw new Error("validateSignerOutput: pubkey must be 64 lowercase hex chars");
+  }
+  if (typeof signedEvent.sig !== "string" || !/^[0-9a-f]{128}$/.test(signedEvent.sig)) {
+    throw new Error("validateSignerOutput: sig must be 128 lowercase hex chars");
+  }
+  if (typeof signedEvent.created_at !== "number") {
+    throw new Error("validateSignerOutput: created_at must be a number");
+  }
+  if (typeof signedEvent.kind !== "number") {
+    throw new Error("validateSignerOutput: kind must be a number");
+  }
+  if (!Array.isArray(signedEvent.tags)) {
+    throw new Error("validateSignerOutput: tags must be an array");
+  }
+  if (typeof signedEvent.content !== "string") {
+    throw new Error("validateSignerOutput: content must be a string");
+  }
+  if (signedEvent.kind !== template.kind) {
+    throw new Error(`validateSignerOutput: kind changed (template=${template.kind}, signed=${signedEvent.kind})`);
+  }
+  if (signedEvent.content !== template.content) {
+    throw new Error("validateSignerOutput: content was changed by signer");
+  }
+  if (signedEvent.created_at !== template.created_at) {
+    throw new Error(`validateSignerOutput: created_at changed (template=${template.created_at}, signed=${signedEvent.created_at})`);
+  }
+  if (signedEvent.tags.length !== template.tags.length) {
+    throw new Error(`validateSignerOutput: tags length changed (template=${template.tags.length}, signed=${signedEvent.tags.length})`);
+  }
+  for (let i = 0; i < template.tags.length; i++) {
+    const tTag = template.tags[i];
+    const sTag = signedEvent.tags[i];
+    if (!Array.isArray(sTag) || sTag.length !== tTag.length) {
+      throw new Error(`validateSignerOutput: tag ${i} shape changed`);
+    }
+    for (let j = 0; j < tTag.length; j++) {
+      if (sTag[j] !== tTag[j]) {
+        throw new Error(`validateSignerOutput: tag ${i} element ${j} changed`);
+      }
+    }
+  }
+  if (expectedPubkey && signedEvent.pubkey !== expectedPubkey) {
+    throw new Error(`validateSignerOutput: pubkey mismatch (expected=${expectedPubkey?.substring(0, 16)}..., got=${signedEvent.pubkey.substring(0, 16)}...)`);
+  }
+  const computedId = computeEventId(signedEvent);
+  if (signedEvent.id !== computedId) {
+    throw new Error(`validateSignerOutput: id mismatch (signed=${signedEvent.id.substring(0, 16)}..., computed=${computedId.substring(0, 16)}...)`);
+  }
+  const hash = sha256(new TextEncoder().encode(JSON.stringify([
+    0,
+    signedEvent.pubkey,
+    signedEvent.created_at,
+    signedEvent.kind,
+    signedEvent.tags,
+    signedEvent.content
+  ])));
+  const sig = hexToBytes3(signedEvent.sig);
+  const pubkey = hexToBytes3(signedEvent.pubkey);
+  if (!schnorr.verify(sig, hash, pubkey)) {
+    throw new Error("validateSignerOutput: invalid Schnorr signature");
+  }
+  const allowedFields = /* @__PURE__ */ new Set(["id", "pubkey", "created_at", "kind", "tags", "content", "sig"]);
+  for (const key of Object.keys(signedEvent)) {
+    if (!allowedFields.has(key)) {
+      throw new Error(`validateSignerOutput: unexpected extra field '${key}'`);
+    }
+  }
+  return signedEvent;
 }
 var NIP_QR_KIND = 9999;
 function buildKind1Announcement(hexPubkey, blockHeight, pqKeys) {
@@ -9879,6 +9979,20 @@ function verifyNIPQRContent(kind11112Content, kind11112Tags, options = {}) {
   const results = [];
   const errors = [];
   const { expectedAuthor, outerPubkey } = options;
+  if (typeof kind11112Content === "string" && kind11112Content.length > MAX_EVENT_JSON_SIZE) {
+    return {
+      results: [{ algorithm: "event", valid: false, note: "content exceeds maximum size" }],
+      kind1Event: null,
+      fullHash: null,
+      sha256Valid: false,
+      eTagValid: false,
+      pqProofsValid: false,
+      policySufficient: false,
+      identityBound: false,
+      validForMigration: false,
+      errors: ["content exceeds maximum size"]
+    };
+  }
   function pushResult(algorithm, valid, note) {
     results.push({ algorithm, valid, note });
     if (!valid) errors.push(`${algorithm}: ${note || "INVALID"}`);
@@ -10439,6 +10553,8 @@ var OtsReader = class {
   }
 };
 var OTS_MAGIC = hexToBytes3("004f70656e54696d657374616d7073000050726f6f6600bf89e2e884e89294");
+var MAX_OTS_PROOF_SIZE = 1 << 20;
+var MAX_EVENT_JSON_SIZE = 1 << 16;
 var BITCOIN_ATTESTATION_TAG = hexToBytes3("0588960d73d71901");
 var LITECOIN_ATTESTATION_TAG = hexToBytes3("06869a0d73d71b45");
 var PENDING_ATTESTATION_TAG = hexToBytes3("83dfe30d2ef90c8e");
@@ -10449,30 +10565,35 @@ function bytesEqual(a, b) {
 }
 function parseOtsFile(otsBytes) {
   if (!(otsBytes instanceof Uint8Array) || otsBytes.length < OTS_MAGIC.length) return null;
-  const reader = new OtsReader(otsBytes);
-  const magic = reader.readBytes(OTS_MAGIC.length);
-  if (!bytesEqual(magic, OTS_MAGIC)) return null;
-  const version = reader.readVaruint();
-  if (version !== 1) return null;
-  const hashOpTag = reader.readByte();
-  let fileHashOp = "unknown";
-  let digestLen = 32;
-  if (hashOpTag === 8) {
-    fileHashOp = "sha256";
-    digestLen = 32;
-  } else if (hashOpTag === 2) {
-    fileHashOp = "sha1";
-    digestLen = 20;
-  } else if (hashOpTag === 3) {
-    fileHashOp = "ripemd160";
-    digestLen = 20;
-  } else {
+  if (otsBytes.length > MAX_OTS_PROOF_SIZE) return null;
+  try {
+    const reader = new OtsReader(otsBytes);
+    const magic = reader.readBytes(OTS_MAGIC.length);
+    if (!bytesEqual(magic, OTS_MAGIC)) return null;
+    const version = reader.readVaruint();
+    if (version !== 1) return null;
+    const hashOpTag = reader.readByte();
+    let fileHashOp = "unknown";
+    let digestLen = 32;
+    if (hashOpTag === 8) {
+      fileHashOp = "sha256";
+      digestLen = 32;
+    } else if (hashOpTag === 2) {
+      fileHashOp = "sha1";
+      digestLen = 20;
+    } else if (hashOpTag === 3) {
+      fileHashOp = "ripemd160";
+      digestLen = 20;
+    } else {
+      return null;
+    }
+    const targetDigest = reader.readBytes(digestLen);
+    const attestations = [];
+    _parseTimestamp(reader, targetDigest, attestations, 0);
+    return { fileHashOp, targetDigest, attestations };
+  } catch (e) {
     return null;
   }
-  const targetDigest = reader.readBytes(digestLen);
-  const attestations = [];
-  _parseTimestamp(reader, targetDigest, attestations, 0);
-  return { fileHashOp, targetDigest, attestations };
 }
 function _parseTimestamp(reader, msg, attestations, depth) {
   if (depth > 512) throw new Error("OTS: recursion limit exceeded");
@@ -10684,6 +10805,7 @@ export {
   signWithSLHDSA,
   timestampEvent,
   upgradeOts,
+  validateSignerOutput,
   verifyFalcon,
   verifyMLDSA44,
   verifyMLDSA65,

www/verify.html

@@ -253,13 +253,21 @@
 
       <div class="pq-card">
         <div class="pq-card-title">Verify NIP-QR Migration Event</div>
+        <div class="pq-info-text" style="color: var(--accent-color); font-size: 13px;">
+          <strong>Research prototype.</strong> Verification confirms key linkage and signature
+          validity; it does not mean the identity is post-quantum secure. Bitcoin OTS confirmation
+          is API-assisted (trusts a public explorer), not a full light-client verification.
+        </div>
         <div class="pq-info-text">
-          Verify post-quantum migration events (kind 11112) by querying relays for a user's pubkey,
-          or by pasting event JSON directly. The kind 11112 event wraps a kind 1 announcement
-          (embedded in its content as JSON) and carries an OpenTimestamps proof. Verification checks:
-          the kind 11112 secp256k1 signature, the embedded kind 1 event's secp256k1 signature,
-          the e tag (kind 1 event ID), the sha256 tag (full kind 1 event hash), all PQ signatures
-          (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512, ML-KEM-768), and the OpenTimestamps proof.
+          Verify post-quantum migration events (kind 9999) by querying relays for a user's pubkey,
+          or by pasting event JSON directly. The kind 9999 event wraps a kind 1 announcement
+          (embedded in its content as JSON) and carries an OpenTimestamps proof. Verification checks,
+          reported as separate result lines:
+          the kind 9999 secp256k1 signature, the embedded kind 1 event's secp256k1 signature,
+          the e tag (kind 1 event ID), the sha256 tag (full kind 1 event hash), each PQ signature
+          individually (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512; ML-KEM-768 has no signature),
+          the PQ algorithm policy (all mandatory algorithms present and verified), identity binding
+          (outer/embedded/expected author match), and the OpenTimestamps proof.
         </div>
         <div class="pq-info-text">
           <a href="./" class="pq-link">Back to migration page</a>
@@ -274,7 +282,7 @@
         <div class="pq-tab-panel pq-tab-panel-active" id="pqPanelRelay">
           <div class="pq-info-text">
             Enter a Nostr pubkey (hex or npub) and one or more relay URLs. The page will query the
-            relay(s) for the latest kind 11112 event from that pubkey and verify it.
+            relay(s) for the latest kind 9999 event from that pubkey and verify it.
           </div>
           <input type="text" class="pq-input" id="pqPubkeyInput"
             placeholder="Pubkey (hex or npub), e.g. 3bf0c63f869a8972... or npub1..." />
@@ -288,13 +296,13 @@
         <!-- TAB 2: Paste Event JSON -->
         <div class="pq-tab-panel" id="pqPanelPaste">
           <div class="pq-info-text">
-            Paste a kind 11112 event JSON below to verify all signatures.
+            Paste a kind 9999 event JSON below to verify all signatures.
           </div>
-          <textarea class="pq-textarea" id="pqEventInput" placeholder='Paste kind 11112 event JSON here, e.g.:
+          <textarea class="pq-textarea" id="pqEventInput" placeholder='Paste kind 9999 event JSON here, e.g.:
 {
   "id": "...",
   "pubkey": "...",
-  "kind": 11112,
+  "kind": 9999,
   "content": "{\"id\":\"...\",\"pubkey\":\"...\",\"kind\":1,\"content\":\"I am signaling...\",\"tags\":[...],\"sig\":\"...\"}",
   "tags": [
     ["e", "<kind 1 event id>"],
@@ -330,7 +338,7 @@
           <div id="pqOtsInfo" class="pq-status pq-status-info"></div>
           <div class="pq-button-row">
             <button class="pq-button" id="pqOtsUpgradeBtn">Upgrade OTS Proof</button>
-            <button class="pq-button" id="pqOtsRepublishBtn" style="display:none;">Republish with Confirmed Proof</button>
+            <button class="pq-button" id="pqOtsRepublishBtn" style="display:none;">Publish Upgraded Event</button>
           </div>
           <div id="pqOtsUpgradeStatus"></div>
         </div>
@@ -367,6 +375,7 @@
     import {
       verifyNIPQRContent,
       verifyNostrEvent,
+      validateSignerOutput,
       NIP_QR_KIND,
       buildUpgradedEvent,
       buildProofCarrier,
@@ -844,7 +853,7 @@
         if (confirmed) {
           const att = verifyResult.bitcoinAttestations[0];
           const date = att ? new Date(att.time * 1000).toISOString().substring(0, 19) : 'unknown';
-          setStatus(otsUpgradeStatus, 'success', `Bitcoin attestation verified! Block ${att ? att.height : '?'} (mined ${date} UTC). Proof upgraded (${currentOtsBytes.length} bytes). You can republish the event with the confirmed proof below.`);
+          setStatus(otsUpgradeStatus, 'success', `Bitcoin attestation verified! Block ${att ? att.height : '?'} (mined ${date} UTC). Proof upgraded (${currentOtsBytes.length} bytes). You can publish a new kind 9999 event carrying the confirmed proof below; it will reference the original via an upgrade_of tag.`);
           otsUpgradeBtn.style.display = 'none';
           otsRepublishBtn.style.display = 'inline-block';
           setOtsBadge('pq-ots-badge-confirmed', 'OTS: Verified (Bitcoin)');
@@ -866,11 +875,13 @@
 
       try {
         if (!window.nostr || !window.nostr.signEvent) {
-          throw new Error('Nostr signer (window.nostr) not available. Use a NIP-07 signer extension to republish.');
+          throw new Error('Nostr signer (window.nostr) not available. Use a NIP-07 signer extension to publish the upgraded event.');
         }
 
         const upgradedTemplate = buildUpgradedEvent(currentEvent, currentOtsBytes);
         const signedEvent = await window.nostr.signEvent(upgradedTemplate);
+        // G56-05: validate signer output before publishing
+        const validatedEvent = validateSignerOutput(signedEvent, upgradedTemplate, currentEvent.pubkey);
 
         // Publish to the relays from the relay input field
         const relayInput = document.getElementById('pqRelayInput').value.trim();
@@ -879,7 +890,7 @@
           throw new Error('No relay URLs specified in the relay input field.');
         }
 
-        const eventJson = JSON.stringify(['EVENT', signedEvent]);
+        const eventJson = JSON.stringify(['EVENT', validatedEvent]);
         const publishResults = await Promise.all(relayUrls.map(url => {
           return new Promise((resolve) => {
             try {
@@ -890,7 +901,7 @@
               ws.onmessage = (msg) => {
                 try {
                   const data = JSON.parse(msg.data);
-                  if (data[0] === 'OK' && data[1] === signedEvent.id) {
+                  if (data[0] === 'OK' && data[1] === validatedEvent.id) {
                     if (!done) { done = true; clearTimeout(t); try { ws.close(); } catch(e){} resolve({ url, success: true }); }
                   }
                 } catch (e) {}
@@ -908,12 +919,12 @@
           throw new Error(`No relay accepted the upgraded event (${fail} failed).`);
         }
 
-        currentEvent = signedEvent;
-        setStatus(otsUpgradeStatus, 'success', `Upgraded kind 11112 event published to ${ok} relay(s) (${fail} failed).`);
+        currentEvent = validatedEvent;
+        setStatus(otsUpgradeStatus, 'success', `Upgraded proof carrier published to ${ok} relay(s) (${fail} failed).`);
         // Re-verify the new event
-        await verifyEvent(signedEvent);
+        await verifyEvent(validatedEvent);
       } catch (error) {
-        setStatus(otsUpgradeStatus, 'error', `Republish failed: ${error.message}`);
+        setStatus(otsUpgradeStatus, 'error', `Publish failed: ${error.message}`);
       } finally {
         otsRepublishBtn.disabled = false;
       }
@@ -923,7 +934,7 @@
        AUTO-DETECT SIGNED-IN USER
        On page load, check for a NIP-07 signer / nostr-login-lite. If the
        user is already signed in, pre-fill the pubkey field and auto-query
-       relays for their kind 11112 event.
+       relays for their kind 9999 event.
        ================================================================ */
     async function initAutoDetect() {
       // Initialize nostr-login-lite if available (shares session with main page)